Keycloak: Invalid SAML Response by External IdP

user_3612623 0
Viewed 3992

I am implementing a SSO option using SAML with an external IdP. If I inspect received SAML response after I click on the SSO button in the browser, I can see the authentication data that I need (such as the name of the user and the email), so the communication with the IdP works just fine.

However Keycloak does not perform the login and shows me a page where it says: "We are sorry... Login timeout, Please log in again.", and no new user is registered. The login timeout for tokens in my realm is set to 30 minutes.

Looking at the logs I find the following error:

keycloak_1  | 00:38:27,888 ERROR [org.keycloak.broker.saml.SAMLEndpoint] (default task-26) Assertion expired.
keycloak_1  | 00:38:27,889 WARN  [org.keycloak.events] (default task-26) type=IDENTITY_PROVIDER_RESPONSE_ERROR, realmId=master, clientId=null, userId=null, ipAddress=172.20.0.1, error=invalid_saml_response

I found that this could be due to the disparity of the EntityID in the IdP and the SP, but I contacted my IdP and the EntityID is the same.

What could be the problem?

sp idp keycloak saml single-sign-on
3 Answers

Generally, SAML response is not valid. It can be anything: wrong entity ID, wrong time, wrong signing/encryption signature, ....

Source code reference

user_33486040

Apparently the issue was that the internal date of docker containers stops updating when the computer goes on standby, so this created a discrepancy between the outdated date of the Service Provider on the docker container and the real date of the identity provider. Simply restarting docker fixed the issue.

user_36126230

It can be a problem of a gap that is too big between the clock of the Keycloak host and the clock of the IDP host.

If it is the case, then it can be resolved by setting the "Allowed clock skew" parameter on the IDP configuration page in Keycloak.

If the gap is x seconds between the clock of each host, set "Allowed clock skew" to at least x.

user_18797310
Related