# \[BUG-1532\] SAML IdP fail to import metadata **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [January 8, 2021, 9:25pm UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079 "2021-01-08T21:25:31Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![nickbrickner](https://avatars.discourse-cdn.com/v4/letter/n/9de0a6/32.png) [@nickbrickner](https://forum.inductiveautomation.com/u/nickbrickner)\ **Post date:** [January 8, 2021, 9:25pm UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/1 "2021-01-08T21:25:31Z")
I’m trying to configure a SAML 2.0 IdP with Shibboleth, but the metadata import fails. I also tried saving as a file to import, but that failed too. The log shows an Error Handling Route. Is anyone familiar with configuring Shibboleth for SSO through Ignition yet? ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [January 8, 2021, 9:40pm UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/2 "2021-01-08T21:40:37Z")
In what way does the import fail? Are there any error messages in the gateway logs when the import fails? ---
**Author:** ![nickbrickner](https://avatars.discourse-cdn.com/v4/letter/n/9de0a6/32.png) [@nickbrickner](https://forum.inductiveautomation.com/u/nickbrickner)\ **Post date:** [January 8, 2021, 11:12pm UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/3 "2021-01-08T23:12:39Z")
Next to the import button, the only message that pops up is “import failed” in red. See attached for the Error Handling Route message from the log. ![SAML error handling route- forum post](https://us1.discourse-cdn.com/inductiveautomation/original/3X/c/5/c59b7e2d496b1172f279767263fe511482e756b1.png) ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [January 8, 2021, 11:19pm UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/4 "2021-01-08T23:19:53Z")
Could you copy and paste the entire stacktrace text here? I can’t see which line number is referenced on the first line of the stack since it is cut off. ---
**Author:** ![nickbrickner](https://avatars.discourse-cdn.com/v4/letter/n/9de0a6/32.png) [@nickbrickner](https://forum.inductiveautomation.com/u/nickbrickner)\ **Post date:** [January 9, 2021, 12:16am UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/5 "2021-01-09T00:16:48Z")
java.lang.NullPointerException: null at com.inductiveautomation.ignition.gateway.auth.web.strategy.saml.SAMLWebAuthStrategyAdapter.importProviderMetadata(SAMLWebAuthStrategyAdapter.java:580) at com.inductiveautomation.ignition.gateway.auth.idp.IdpAdapterConfigRoutes.importProviderMetadata(IdpAdapterConfigRoutes.java:561) at com.inductiveautomation.ignition.gateway.dataroutes.Route.service(Route.java:252) at com.inductiveautomation.ignition.gateway.dataroutes.RouteGroupImpl.service(RouteGroupImpl.java:61) at com.inductiveautomation.ignition.gateway.dataroutes.RouteGroupCollectionServlet.serviceInternal(RouteGroupCollectionServlet.java:54) at com.inductiveautomation.ignition.gateway.dataroutes.AbstractRouteGroupServlet.service(AbstractRouteGroupServlet.java:38) at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) at org.eclipse.jetty.servlet.ServletHolder$NotAsyncServlet.service(ServletHolder.java:1391) at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:760) at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:547) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143) at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:590) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235) at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1607) at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233) at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1297) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188) at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:485) at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1577) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186) at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1212) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) at org.eclipse.jetty.rewrite.handler.RewriteHandler.handle(RewriteHandler.java:322) at org.eclipse.jetty.server.handler.HandlerList.handle(HandlerList.java:59) at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:146) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) at org.eclipse.jetty.server.Server.handle(Server.java:500) at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:383) at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:547) at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:375) at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:270) at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311) at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103) at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.onFillable(SslConnection.java:543) at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:398) at org.eclipse.jetty.io.ssl.SslConnection$2.succeeded(SslConnection.java:161) at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103) at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:117) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:336) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:313) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:171) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:129) at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:388) at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:806) at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:938) at java.base/java.lang.Thread.run(Unknown Source) ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [January 9, 2021, 12:30am UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/6 "2021-01-09T00:30:02Z")
Can you attach (or DM me) a copy of your IdP’s metadata XML which is causing the NPE? ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [January 9, 2021, 2:23am UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/7 "2021-01-09T02:23:17Z")
For posterity, @nickbrickner DM’d me the failing metadata XML, and turns out there is a bug in Ignition’s code which does not properly process IdP metadata when any `KeyDescriptor` tag under a `IDPSSODescriptor` tag is missing the `use` attribute. According to the SAML spec, the `use` attribute may be omitted, and if omitted, should be treated as `use="signing"`. I’ve logged a ticket to fix this, and as a workaround for anyone running into this issue, you may download the metadata XML to a file on your computer, open it with a text editor, and change the following XML tag under the `IDPSSODescriptor` XML tag from `` to `` , then import the metadata file into Ignition and it should work. ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [January 25, 2021, 7:04pm UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/8 "2021-01-25T19:04:32Z")
This bug was fixed and made it into the latest 8.1.3 nightly build. ---
**Author:** ![CTrenkamp](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ctrenkamp/32/38440_2.png) [@CTrenkamp](https://forum.inductiveautomation.com/u/CTrenkamp)\ **Post date:** [August 22, 2024, 2:36pm UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/9 "2024-08-22T14:36:50Z")
I just got the same problem with version 8.1.38. I have done this with 32 other sites and no issue but I just hit one that does. The keydescriptor also has the use="signing" in it as suggested. ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [August 22, 2024, 5:37pm UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/10 "2024-08-22T17:37:29Z")
What is the exact error that you ran into? Can you share a stacktrace from the Gateway logs? We recently fixed a SAML Metadata import regression in 8.1.43 that was introduced in 8.1.34, I'm wondering if you ran into that... ---
**Author:** ![CTrenkamp](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ctrenkamp/32/38440_2.png) [@CTrenkamp](https://forum.inductiveautomation.com/u/CTrenkamp)\ **Post date:** [August 22, 2024, 5:43pm UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/11 "2024-08-22T17:43:34Z")
Error handling route. Further logging for this event will be DEBUG com.inductiveautomation.ignition.gateway.auth.web.strategy.WebAuthStrategyAdapterException: Unable to deserialize the SAML Metadata at com.inductiveautomation.ignition.gateway.auth.web.strategy.saml.SAMLWebAuthStrategyAdapter.deserialize(SAMLWebAuthStrategyAdapter.java:450) at com.inductiveautomation.ignition.gateway.auth.web.strategy.saml.SAMLWebAuthStrategyAdapter.doImportProviderMetadata(SAMLWebAuthStrategyAdapter.java:499) at com.inductiveautomation.ignition.gateway.auth.web.strategy.saml.SAMLWebAuthStrategyAdapter.importProviderMetadata(SAMLWebAuthStrategyAdapter.java:725) at com.inductiveautomation.ignition.gateway.auth.idp.IdpAdapterConfigRoutes.importProviderMetadata(IdpAdapterConfigRoutes.java:584) at com.inductiveautomation.ignition.gateway.dataroutes.Route.service(Route.java:254) at com.inductiveautomation.ignition.gateway.dataroutes.RouteGroupImpl.service(RouteGroupImpl.java:64) at com.inductiveautomation.ignition.gateway.dataroutes.RouteGroupCollectionServlet.serviceInternal(RouteGroupCollectionServlet.java:59) at com.inductiveautomation.ignition.gateway.dataroutes.AbstractRouteGroupServlet.service(AbstractRouteGroupServlet.java:38) at javax.servlet.http.HttpServlet.service(HttpServlet.java:590) at org.eclipse.jetty.servlet.ServletHolder$NotAsync.service(ServletHolder.java:1410) at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:764) at org.eclipse.jetty.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1665) at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:527) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:131) at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:578) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122) at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:223) at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1570) at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:221) at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1384) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:176) at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:484) at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1543) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:174) at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1306) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:129) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122) at com.inductiveautomation.catapult.handlers.RemoteHostNameLookupHandler.handle(RemoteHostNameLookupHandler.java:121) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122) at org.eclipse.jetty.rewrite.handler.RewriteHandler.handle(RewriteHandler.java:301) at org.eclipse.jetty.server.handler.HandlerList.handle(HandlerList.java:51) at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:141) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122) at org.eclipse.jetty.server.Server.handle(Server.java:563) at org.eclipse.jetty.server.HttpChannel.lambda$handle$0(HttpChannel.java:505) at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:762) at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:497) at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:282) at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:314) at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100) at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.onFillable(SslConnection.java:558) at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:379) at org.eclipse.jetty.io.ssl.SslConnection$2.succeeded(SslConnection.java:146) at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100) at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:416) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:385) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:272) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.lambda$new$0(AdaptiveExecutionStrategy.java:140) at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:411) at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:969) at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1194) at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1149) [at java.base/java.lang.Thread.run(Unknown Source)](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/Thread.html) Caused by: com.inductiveautomation.ignition.gateway.auth.saml.serialization.SAMLDeserializerException: Unable to parse the Document at com.inductiveautomation.ignition.gateway.auth.saml.serialization.AbstractSAMLDeserializer.deserialize(AbstractSAMLDeserializer.java:43) at com.inductiveautomation.ignition.gateway.auth.web.strategy.saml.SAMLWebAuthStrategyAdapter.deserialize(SAMLWebAuthStrategyAdapter.java:448) ... 53 common frames omitted Caused by: com.inductiveautomation.ignition.gateway.auth.saml.parsing.SAMLDocumentParserException: Unable to parse the SAML document at com.inductiveautomation.ignition.gateway.auth.saml.parsing.SAMLDocumentParserImpl.parse(SAMLDocumentParserImpl.java:40) at com.inductiveautomation.ignition.gateway.auth.saml.parsing.SAMLDocumentParserDecorator.parse(SAMLDocumentParserDecorator.java:28) at com.inductiveautomation.ignition.gateway.auth.saml.parsing.SchemaValidatingSAMLDocumentParser.parse(SchemaValidatingSAMLDocumentParser.java:86) at com.inductiveautomation.ignition.gateway.auth.saml.parsing.SAMLDocumentParserDecorator.parse(SAMLDocumentParserDecorator.java:28) at com.inductiveautomation.ignition.gateway.auth.saml.parsing.IdTaggingSAMLDocumentParserDecorator.parse(IdTaggingSAMLDocumentParserDecorator.java:43) at com.inductiveautomation.ignition.gateway.auth.saml.serialization.AbstractSAMLDeserializer.deserialize(AbstractSAMLDeserializer.java:41) ... 54 common frames omitted Caused by: org.xml.sax.SAXParseException: Content is not allowed in prolog. at java.xml/com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(Unknown Source) at java.xml/com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderImpl.parse(Unknown Source) [at java.xml/javax.xml.parsers.DocumentBuilder.parse(Unknown Source)](https://docs.oracle.com/en/java/javase/17/docs/api/java.xml/javax/xml/parsers/DocumentBuilder.html) at com.inductiveautomation.ignition.gateway.auth.saml.parsing.SAMLDocumentParserImpl.parse(SAMLDocumentParserImpl.java:38) ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [August 22, 2024, 5:56pm UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/12 "2024-08-22T17:56:13Z")
> Caused by: org.xml.sax.SAXParseException: Content is not allowed in prolog This root cause lines up with the bug we fixed in 8.1.43. Two options: 1. Upgrade to 8.1.43 2. Download an Ignition 8.1 build prior to 8.1.34, import the SAML metadata on that version, save the IdP, then export the SAML IdP and import it into your 8.1.38 instance. One thing with this approach is that it will overwrite the rest of your IdP's config such as user attribute mappings, user grants, and security level rules, so you will have to make sure to go back and fix those settings after import. I'd recommend importing to a new IdP, get the settings the way you want it on the new one, and then point to this new IdP anywhere in Ignition where you reference the old IdP (should make for a smoother cutover in theory). ---
**Author:** ![CTrenkamp](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ctrenkamp/32/38440_2.png) [@CTrenkamp](https://forum.inductiveautomation.com/u/CTrenkamp)\ **Post date:** [August 22, 2024, 6:24pm UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/13 "2024-08-22T18:24:10Z")
Upgrading will be our option, thanks. ---
**Author:** ![Aashi\_Sharma](https://avatars.discourse-cdn.com/v4/letter/a/7ea924/32.png) [@Aashi\_Sharma](https://forum.inductiveautomation.com/u/Aashi_Sharma)\ **Post date:** [September 12, 2024, 8:15am UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/14 "2024-09-12T08:15:28Z")
I am also getting below exception while starting my application: Metadata refreshing has failed: java.lang.NullPointerException this my idp mtadata xml [keycloak-metadata.xml](https://forum.inductiveautomation.com/uploads/short-url/tf3bdd7urLOJ63HyEDcJbIw8OtU.xml) (2.8 KB) ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [September 12, 2024, 3:51pm UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/15 "2024-09-12T15:51:09Z")
Can you share the full stacktrace? ---
**Author:** ![Aashi\_Sharma](https://avatars.discourse-cdn.com/v4/letter/a/7ea924/32.png) [@Aashi\_Sharma](https://forum.inductiveautomation.com/u/Aashi_Sharma)\ **Post date:** [September 13, 2024, 8:20am UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/16 "2024-09-13T08:20:39Z")
Caused by: org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'samlEntryPoint': Unsatisfied dependency expressed through method 'setMetadata' parameter 0; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'metadata' defined in class path resource [appcontext-security.xml]: Invocation of init method failed; nested exception is java.lang.NullPointerException Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'metadata' defined in class path resource [appcontext-security.xml]: Invocation of init method failed; nested exception is java.lang.NullPointerException Caused by: java.lang.NullPointerException" ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [September 13, 2024, 11:26am UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/17 "2024-09-13T11:26:17Z")
A "full backtrace" includes the parts with all the line numbers, and and appended "Caused by" sections. ---
**Author:** ![Aashi\_Sharma](https://avatars.discourse-cdn.com/v4/letter/a/7ea924/32.png) [@Aashi\_Sharma](https://forum.inductiveautomation.com/u/Aashi_Sharma)\ **Post date:** [September 13, 2024, 11:43am UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/18 "2024-09-13T11:43:24Z")
Actually, its happening when I am starting my application. The whole configuration is done in spring-security-context.xml. So there is no specific code line at which its happening: 17:09:43,631 WARN [org.springframework.security.saml.metadata.MetadataManager] (Metadata-reload) Metadata refreshing has failed: java.lang.NullPointerException at org.springframework.security.saml.metadata.MetadataManager.getTrustEngine(MetadataManager.java:588) [spring-security-saml2-core-1.0.3.RELEASE.jar:1.0.3.RELEASE] at org.springframework.security.saml.metadata.MetadataManager.initializeProviderFilters(MetadataManager.java:523) [spring-security-saml2-core-1.0.3.RELEASE.jar:1.0.3.RELEASE] at org.springframework.security.saml.metadata.MetadataManager.refreshMetadata(MetadataManager.java:237) [spring-security-saml2-core-1.0.3.RELEASE.jar:1.0.3.RELEASE] at org.springframework.security.saml.metadata.CachingMetadataManager.refreshMetadata(CachingMetadataManager.java:86) [spring-security-saml2-core-1.0.3.RELEASE.jar:1.0.3.RELEASE] at org.springframework.security.saml.metadata.MetadataManager$RefreshTask.run(MetadataManager.java:1040) [spring-security-saml2-core-1.0.3.RELEASE.jar:1.0.3.RELEASE] at java.util.TimerThread.mainLoop(Timer.java:555) [rt.jar:1.8.0\_211] at java.util.TimerThread.run(Timer.java:505) [rt.jar:1.8.0\_211] ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [September 13, 2024, 4:45pm UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/19 "2024-09-13T16:45:13Z")
Where are you getting these stack traces from? They don't appear to come from Ignition since Ignition does not use the Spring framework... ---
**Author:** ![mahsasalimi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mahsasalimi/32/68520_2.png) [@mahsasalimi](https://forum.inductiveautomation.com/u/mahsasalimi)\ **Post date:** [March 26, 2025, 3:25pm UTC](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079/20 "2025-03-26T15:25:37Z")
I get similar error , 8.1.44 trying to import from keycloak ```python Route 26Mar2025 16:20:32 Error handling route. Further logging for this event will be DEBUG javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source) at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source) at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source) at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source) at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(Unknown Source) at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(Unknown Source) at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(Unknown Source) at java.base/sun.security.ssl.SSLHandshake.consume(Unknown Source) at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source) at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source) at java.base/sun.security.ssl.TransportContext.dispatch(Unknown Source) at java.base/sun.security.ssl.SSLTransport.decode(Unknown Source) at java.base/sun.security.ssl.SSLSocketImpl.decode(Unknown Source) at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(Unknown Source) at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source) at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source) at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:436) at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:384) at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142) at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376) at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393) at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236) at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186) at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89) at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110) at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185) at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83) at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108) at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56) at com.inductiveautomation.ignition.gateway.auth.idp.IdpAdapterConfigRoutes.importProviderMetadata(IdpAdapterConfigRoutes.java:572) at com.inductiveautomation.ignition.gateway.dataroutes.Route.service(Route.java:254) at com.inductiveautomation.ignition.gateway.dataroutes.RouteGroupImpl.service(RouteGroupImpl.java:64) at com.inductiveautomation.ignition.gateway.dataroutes.RouteGroupCollectionServlet.serviceInternal(RouteGroupCollectionServlet.java:59) at com.inductiveautomation.ignition.gateway.dataroutes.AbstractRouteGroupServlet.service(AbstractRouteGroupServlet.java:38) at javax.servlet.http.HttpServlet.service(HttpServlet.java:590) at org.eclipse.jetty.servlet.ServletHolder$NotAsync.service(ServletHolder.java:1410) at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:764) at org.eclipse.jetty.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1665) at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:527) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:131) at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:598) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122) at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:223) at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1580) at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:221) at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1384) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:176) at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:484) at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1553) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:174) at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1306) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:129) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122) at com.inductiveautomation.catapult.handlers.RemoteHostNameLookupHandler.handle(RemoteHostNameLookupHandler.java:121) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122) at org.eclipse.jetty.rewrite.handler.RewriteHandler.handle(RewriteHandler.java:301) at org.eclipse.jetty.server.handler.HandlerList.handle(HandlerList.java:51) at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:141) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122) at org.eclipse.jetty.server.Server.handle(Server.java:563) at org.eclipse.jetty.server.HttpChannel$RequestDispatchable.dispatch(HttpChannel.java:1598) at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:753) at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:501) at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:287) at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:314) at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100) at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.onFillable(SslConnection.java:558) at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:379) at org.eclipse.jetty.io.ssl.SslConnection$2.succeeded(SslConnection.java:146) at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100) at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:421) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:390) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:277) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.run(AdaptiveExecutionStrategy.java:199) at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:411) at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:969) at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1194) at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1149) at java.base/java.lang.Thread.run(Unknown Source) Caused by: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors at java.base/sun.security.validator.PKIXValidator.doValidate(Unknown Source) at java.base/sun.security.validator.PKIXValidator.engineValidate(Unknown Source) at java.base/sun.security.validator.Validator.validate(Unknown Source) at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source) at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source) ... 76 common frames omitted Caused by: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors at java.base/sun.security.provider.certpath.PKIXCertPathValidator.validate(Unknown Source) at java.base/sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(Unknown Source) at java.base/java.security.cert.CertPathValidator.validate(Unknown Source) ... 81 common frames omitted ``` [Next page](https://forum.inductiveautomation.com/t/bug-1532-saml-idp-fail-to-import-metadata/42079.md?page=2)