# Examples for setting up SAML IDP profiles

**URL:** <https://forum.inductiveautomation.com/t/examples-for-setting-up-saml-idp-profiles/25112>\
**Category:** Ignition\
**Tags:** ignition80\
**Created:** [May 17, 2019, 8:04pm UTC](https://forum.inductiveautomation.com/t/examples-for-setting-up-saml-idp-profiles/25112 "2019-05-17T20:04:51Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![mitchell-ACS](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mitchell-acs/32/30062_2.png) [@mitchell-ACS](https://forum.inductiveautomation.com/u/mitchell-ACS)\
**Post date:** [May 17, 2019, 8:04pm UTC](https://forum.inductiveautomation.com/t/examples-for-setting-up-saml-idp-profiles/25112/1 "2019-05-17T20:04:51Z")

</div>

Can we get some examples of how to set up different identity providers?  
I’m very excited about the idea of enabling MFA for my projects but the lingo is over my head and the configuration process has me lost.  
I thought I had gotten to a good place using Okta but I am just getting blank responses on my login tests.  
I’m sure its something I have misconfigured, but I am not sure where to start looking.

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [May 17, 2019, 10:33pm UTC](https://forum.inductiveautomation.com/t/examples-for-setting-up-saml-idp-profiles/25112/2 "2019-05-17T22:33:48Z")

</div>

Hi @mitchell-ACS -

Guides for setting up basic integration between Ignition and some of the major IdP products / services is definitely on the to-do list.

If you are getting blank responses, try setting the following gateway loggers to debug to see if they reveal anything during login:

`gateway.IdpAdapter`  
`gateway.UserAttributeMapper`  
`gateway.ExpressionSecurityLevelPolicy`  
`gateway.WebAuthSessionImpl`

---

<div class="post-metadata">

**Author:** ![mitchell-ACS](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mitchell-acs/32/30062_2.png) [@mitchell-ACS](https://forum.inductiveautomation.com/u/mitchell-ACS)\
**Post date:** [May 18, 2019, 5:28am UTC](https://forum.inductiveautomation.com/t/examples-for-setting-up-saml-idp-profiles/25112/3 "2019-05-18T05:28:29Z")

</div>

> [@jspecht](#):
>
> `gateway.WebAuthSessionImpl`

This is the response in gateway.WebAuthSessionImpl

```auto
com.inductiveautomation.ignition.gateway.auth.idp.IdpAdapterException: Unable to parse the WebAuthResponse from the HTTP request

at com.inductiveautomation.ignition.gateway.auth.idp.IdpAdapter.parseAttributes(IdpAdapter.java:129)

at com.inductiveautomation.ignition.gateway.auth.idp.WebAuthSessionImpl.onLoginResponseInternal(WebAuthSessionImpl.java:176)

at com.inductiveautomation.ignition.gateway.auth.idp.WebAuthSessionImpl.lambda$onLoginResponse$1(WebAuthSessionImpl.java:191)

at com.inductiveautomation.ignition.gateway.auth.idp.WebAuthSessionImpl.mdc(WebAuthSessionImpl.java:93)

at com.inductiveautomation.ignition.gateway.auth.idp.WebAuthSessionImpl.onLoginResponse(WebAuthSessionImpl.java:191)

at com.inductiveautomation.ignition.gateway.auth.idp.IdpAdapterConfigRoutes$TestLoginWebAuthResponseHandler.handle(IdpAdapterConfigRoutes.java:297)

at com.inductiveautomation.ignition.gateway.auth.federation.FederationRoutes.callback(FederationRoutes.java:135)

at com.inductiveautomation.ignition.gateway.dataroutes.Route.service(Route.java:247)

at com.inductiveautomation.ignition.gateway.dataroutes.RouteGroupImpl.service(RouteGroupImpl.java:49)

at com.inductiveautomation.ignition.gateway.dataroutes.DataServlet.service(DataServlet.java:87)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)

at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:852)

at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:535)

at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)

at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:548)

at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)

at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:190)

at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1595)

at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:188)

at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1253)

at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:168)

at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:473)

at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1564)

at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:166)

at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1155)

at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)

at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)

at org.eclipse.jetty.rewrite.handler.RewriteHandler.handle(RewriteHandler.java:335)

at org.eclipse.jetty.server.handler.HandlerList.handle(HandlerList.java:61)

at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:126)

at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)

at org.eclipse.jetty.server.Server.handle(Server.java:530)

at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:347)

at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:256)

at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:279)

at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102)

at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:289)

at org.eclipse.jetty.io.ssl.SslConnection$3.succeeded(SslConnection.java:149)

at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102)

at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:124)

at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:247)

at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.produce(EatWhatYouKill.java:140)

at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:131)

at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:382)

at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:708)

at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:626)

at java.base/java.lang.Thread.run(Unknown Source)

Caused by: com.inductiveautomation.ignition.gateway.auth.web.strategy.WebAuthStrategyException: Unable to create the XML Attribute Source from the SAML Response

at com.inductiveautomation.ignition.gateway.auth.web.strategy.saml.SAMLWebAuthStrategy.parseWebAuthResponse(SAMLWebAuthStrategy.java:58)

at com.inductiveautomation.ignition.gateway.auth.web.strategy.saml.SAMLWebAuthStrategy.parseWebAuthResponse(SAMLWebAuthStrategy.java:22)

at com.inductiveautomation.ignition.gateway.auth.idp.IdpAdapter.parseAttributes(IdpAdapter.java:127)

... 46 common frames omitted

Caused by: com.inductiveautomation.ignition.gateway.auth.saml.binding.http.response.SAMLHttpResponseFactoryException: https://<gatewayURL>:8043 is not a valid audience

at com.inductiveautomation.ignition.gateway.auth.saml.binding.http.response.AbstractSAMLHttpResponseFactory.validateAssertionConditions(AbstractSAMLHttpResponseFactory.java:130)

at com.inductiveautomation.ignition.gateway.auth.saml.binding.http.response.AbstractSAMLHttpResponseFactory.validateAssertion(AbstractSAMLHttpResponseFactory.java:220)

at com.inductiveautomation.ignition.gateway.auth.saml.binding.http.response.AbstractSAMLHttpResponseFactory.validateResponse(AbstractSAMLHttpResponseFactory.java:323)

at com.inductiveautomation.ignition.gateway.auth.saml.binding.http.response.AbstractSAMLHttpResponseFactory.create(AbstractSAMLHttpResponseFactory.java:353)

at com.inductiveautomation.ignition.gateway.auth.web.strategy.saml.SAMLWebAuthStrategy.parseWebAuthResponse(SAMLWebAuthStrategy.java:56)

```

---

<div class="post-metadata">

**Author:** ![mitchell-ACS](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mitchell-acs/32/30062_2.png) [@mitchell-ACS](https://forum.inductiveautomation.com/u/mitchell-ACS)\
**Post date:** [May 18, 2019, 6:14pm UTC](https://forum.inductiveautomation.com/t/examples-for-setting-up-saml-idp-profiles/25112/4 "2019-05-18T18:14:15Z")

</div>

When I check the log for my IDP (Okta in this case) it says the login was successful.

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [May 20, 2019, 3:47pm UTC](https://forum.inductiveautomation.com/t/examples-for-setting-up-saml-idp-profiles/25112/5 "2019-05-20T15:47:28Z")

</div>

Hi @mitchell-ACS -

You may have successfully authenticated with the IdP, but Ignition does not trust an assertion in the response from the IdP because the intended “audience” for the response is not correct. The audience should be the URI (scheme, host, and port only) of the gateway from which you initiated your authentication request (for example: `http://localhost:8088`). In your Okta configuration, this would be set as the `SP Entity ID`.

---

<div class="post-metadata">

**Author:** ![mitchell-ACS](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mitchell-acs/32/30062_2.png) [@mitchell-ACS](https://forum.inductiveautomation.com/u/mitchell-ACS)\
**Post date:** [May 20, 2019, 4:00pm UTC](https://forum.inductiveautomation.com/t/examples-for-setting-up-saml-idp-profiles/25112/6 "2019-05-20T16:00:31Z")

</div>

That fixed it! Thanks @jspecht.

---

<div class="post-metadata">

**Author:** ![Jonathan](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@Jonathan](https://forum.inductiveautomation.com/u/Jonathan)\
**Post date:** [October 28, 2019, 4:51pm UTC](https://forum.inductiveautomation.com/t/examples-for-setting-up-saml-idp-profiles/25112/7 "2019-10-28T16:51:59Z")

</div>

I have the same problem, but I am receiving a different debug message. Any ideas what is causing this?

> WebAuthSessionImpl 28Oct2019 09:46:59 Unable to handle login response  
> com.inductiveautomation.ignition.gateway.auth.idp.IdpAdapterException: Unable to parse the WebAuthResponse from the HTTP request
> 
> at com.inductiveautomation.ignition.gateway.auth.idp.IdpAdapter.parseAttributes(IdpAdapter.java:121)
> 
> at com.inductiveautomation.ignition.gateway.auth.idp.WebAuthSessionImpl.onLoginResponseInternal(WebAuthSessionImpl.java:185)
> 
> at com.inductiveautomation.ignition.gateway.auth.idp.WebAuthSessionImpl.lambda$onLoginResponse$2(WebAuthSessionImpl.java:199)
> 
> at com.inductiveautomation.ignition.gateway.auth.idp.WebAuthSessionImpl.mdc(WebAuthSessionImpl.java:98)
> 
> at com.inductiveautomation.ignition.gateway.auth.idp.WebAuthSessionImpl.onLoginResponse(WebAuthSessionImpl.java:199)
> 
> at com.inductiveautomation.ignition.gateway.auth.idp.IdpAdapterConfigRoutes$TestLoginWebAuthResponseHandler.handle(IdpAdapterConfigRoutes.java:295)
> 
> at com.inductiveautomation.ignition.gateway.auth.federation.FederationRoutes.callback(FederationRoutes.java:111)
> 
> at com.inductiveautomation.ignition.gateway.dataroutes.Route.service(Route.java:247)
> 
> at com.inductiveautomation.ignition.gateway.dataroutes.RouteGroupImpl.service(RouteGroupImpl.java:49)
> 
> at com.inductiveautomation.ignition.gateway.dataroutes.RouteGroupCollectionServlet.serviceInternal(RouteGroupCollectionServlet.java:54)
> 
> at com.inductiveautomation.ignition.gateway.dataroutes.AbstractRouteGroupServlet.service(AbstractRouteGroupServlet.java:32)
> 
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
> 
> at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:852)
> 
> at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:535)
> 
> at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
> 
> at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:548)
> 
> at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
> 
> at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:190)
> 
> at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1595)
> 
> at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:188)
> 
> at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1253)
> 
> at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:168)
> 
> at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:473)
> 
> at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1564)
> 
> at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:166)
> 
> at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1155)
> 
> at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
> 
> at org.eclipse.jetty.server.handler.HandlerList.handle(HandlerList.java:61)
> 
> at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
> 
> at org.eclipse.jetty.rewrite.handler.RewriteHandler.handle(RewriteHandler.java:335)
> 
> at org.eclipse.jetty.server.handler.HandlerList.handle(HandlerList.java:61)
> 
> at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:126)
> 
> at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
> 
> at org.eclipse.jetty.server.Server.handle(Server.java:530)
> 
> at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:347)
> 
> at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:256)
> 
> at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:279)
> 
> at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102)
> 
> at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:289)
> 
> at org.eclipse.jetty.io.ssl.SslConnection$3.succeeded(SslConnection.java:149)
> 
> at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102)
> 
> at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:124)
> 
> at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:247)
> 
> at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.produce(EatWhatYouKill.java:140)
> 
> at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:131)
> 
> at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:382)
> 
> at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:708)
> 
> at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:626)
> 
> at java.base/java.lang.Thread.run(Unknown Source)
> 
> Caused by: com.inductiveautomation.ignition.gateway.auth.web.strategy.WebAuthStrategyException: Unable to create the XML Attribute Source from the SAML Response
> 
> at com.inductiveautomation.ignition.gateway.auth.web.strategy.saml.SAMLWebAuthStrategy.parseWebAuthResponse(SAMLWebAuthStrategy.java:58)
> 
> at com.inductiveautomation.ignition.gateway.auth.web.strategy.saml.SAMLWebAuthStrategy.parseWebAuthResponse(SAMLWebAuthStrategy.java:22)
> 
> at com.inductiveautomation.ignition.gateway.auth.idp.IdpAdapter.parseAttributes(IdpAdapter.java:119)
> 
> ... 48 common frames omitted
> 
> Caused by: com.inductiveautomation.ignition.gateway.auth.saml.binding.http.response.SAMLHttpResponseFactoryException: Unable to deserialize the SAML Response XML Document
> 
> at com.inductiveautomation.ignition.gateway.auth.saml.binding.http.response.AbstractSAMLHttpResponseFactory.create(AbstractSAMLHttpResponseFactory.java:350)
> 
> at com.inductiveautomation.ignition.gateway.auth.web.strategy.saml.SAMLWebAuthStrategy.parseWebAuthResponse(SAMLWebAuthStrategy.java:56)
> 
> ... 50 common frames omitted
> 
> Caused by: com.inductiveautomation.ignition.gateway.auth.saml.serialization.SAMLDeserializerException: Unable to parse the Document
> 
> at com.inductiveautomation.ignition.gateway.auth.saml.serialization.AbstractSAMLDeserializer.deserialize(AbstractSAMLDeserializer.java:43)
> 
> at com.inductiveautomation.ignition.gateway.auth.saml.binding.http.response.AbstractSAMLHttpResponseFactory.create(AbstractSAMLHttpResponseFactory.java:348)
> 
> ... 51 common frames omitted
> 
> Caused by: com.inductiveautomation.ignition.gateway.auth.saml.parsing.SAMLDocumentParserException: Expected one Signature candidate for signed node 0 and xPath /samlp:Response but got 0
> 
> at com.inductiveautomation.ignition.gateway.auth.saml.parsing.SignatureValidatingSAMLDocumentParserDecorator.getOnlyChild(SignatureValidatingSAMLDocumentParserDecorator.java:111)
> 
> at com.inductiveautomation.ignition.gateway.auth.saml.parsing.SignatureValidatingSAMLDocumentParserDecorator.validate(SignatureValidatingSAMLDocumentParserDecorator.java:124)
> 
> at com.inductiveautomation.ignition.gateway.auth.saml.parsing.SignatureValidatingSAMLDocumentParserDecorator.parse(SignatureValidatingSAMLDocumentParserDecorator.java:197)
> 
> at com.inductiveautomation.ignition.gateway.auth.saml.serialization.AbstractSAMLDeserializer.deserialize(AbstractSAMLDeserializer.java:41)

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [October 28, 2019, 5:34pm UTC](https://forum.inductiveautomation.com/t/examples-for-setting-up-saml-idp-profiles/25112/8 "2019-10-28T17:34:21Z")

</div>

Hi @Jonathan -

In this case, you have the `Validate Response Signatures` configuration option enabled on the Ignition side but your IdP is not signing the response.

If you expect the IdP to sign the entire SAML response, then you need to figure out how to set up response signing on the IdP side.

---

<div class="post-metadata">

**Author:** ![imt.sebastian.sanche](https://avatars.discourse-cdn.com/v4/letter/i/ecb155/32.png) [@imt.sebastian.sanche](https://forum.inductiveautomation.com/u/imt.sebastian.sanche)\
**Post date:** [October 1, 2026, 6:06pm UTC](https://forum.inductiveautomation.com/t/examples-for-setting-up-saml-idp-profiles/25112/9 "2026-10-01T18:06:06Z")

</div>

Hi, I have a similar issue. When I disabled the `Validate Response Signatures` it worked one time and I was able to see the XML file but any attempts after that I just get this:

```python
com.inductiveautomation.ignition.gateway.auth.idp.IdentityProviderException: Unable to create the XML Attribute Source from the SAML Response

at com.inductiveautomation.ignition.gateway.auth.idp.saml.SAMLIdentityProvider.parseLoginResponse(SAMLIdentityProvider.java:65)

at com.inductiveautomation.ignition.gateway.auth.idp.IdentityProviderWrapper.parseLoginResponse(IdentityProviderWrapper.java:34)

at com.inductiveautomation.ignition.gateway.auth.idp.WebAuthSession.onLoginResponseInternal(WebAuthSession.java:248)

at com.inductiveautomation.ignition.gateway.auth.idp.WebAuthSession.lambda$onLoginResponse$3(WebAuthSession.java:277)

at com.inductiveautomation.ignition.gateway.auth.idp.WebAuthSession.mdc(WebAuthSession.java:115)

at com.inductiveautomation.ignition.gateway.auth.idp.WebAuthSession.onLoginResponse(WebAuthSession.java:277)

at com.inductiveautomation.ignition.gateway.auth.idp.IdentityProviderConfigRoutes$TestLoginWebAuthResponseHandler.handle(IdentityProviderConfigRoutes.java:403)

at com.inductiveautomation.ignition.gateway.auth.federation.FederationRoutes.callback(FederationRoutes.java:269)

at com.inductiveautomation.ignition.gateway.dataroutes.Route.service(Route.java:355)

at com.inductiveautomation.ignition.gateway.dataroutes.RouteGroupImpl.service(RouteGroupImpl.java:117)

at com.inductiveautomation.ignition.gateway.dataroutes.RouteGroupCollectionServlet.serviceInternal(RouteGroupCollectionServlet.java:151)

at com.inductiveautomation.ignition.gateway.dataroutes.AbstractRouteGroupServlet.service(AbstractRouteGroupServlet.java:40)

at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:614)

at org.eclipse.jetty.ee10.servlet.ServletHolder$NotAsync.service(ServletHolder.java:1387)

at org.eclipse.jetty.ee10.servlet.ServletHolder.handle(ServletHolder.java:753)

at org.eclipse.jetty.ee10.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1624)

at com.inductiveautomation.catapult.filters.GatewayFilter.doFilter(GatewayFilter.java:119)

at jakarta.servlet.http.HttpFilter.doFilter(HttpFilter.java:97)

at org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:205)

at org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1596)

at org.eclipse.jetty.ee10.servlet.ServletHandler$MappedServlet.handle(ServletHandler.java:1557)

at org.eclipse.jetty.ee10.servlet.ServletChannel.dispatch(ServletChannel.java:828)

at org.eclipse.jetty.ee10.servlet.ServletChannel.handle(ServletChannel.java:438)

at org.eclipse.jetty.ee10.servlet.ServletHandler.handle(ServletHandler.java:470)

at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:575)

at org.eclipse.jetty.ee10.servlet.SessionHandler.handle(SessionHandler.java:717)

at org.eclipse.jetty.server.handler.ContextHandler.handle(ContextHandler.java:1102)

at org.eclipse.jetty.rewrite.handler.RewriteHandler$LastRuleHandler.handle(RewriteHandler.java:159)

at org.eclipse.jetty.rewrite.handler.Rule$Handler.handle(Rule.java:108)

at org.eclipse.jetty.rewrite.handler.HeaderPatternRule$1.handle(HeaderPatternRule.java:89)

at org.eclipse.jetty.rewrite.handler.Rule$Handler.handle(Rule.java:108)

at org.eclipse.jetty.rewrite.handler.HeaderPatternRule$1.handle(HeaderPatternRule.java:89)

at org.eclipse.jetty.rewrite.handler.Rule$Handler.handle(Rule.java:108)

at org.eclipse.jetty.rewrite.handler.HeaderPatternRule$1.handle(HeaderPatternRule.java:89)

at org.eclipse.jetty.rewrite.handler.Rule$Handler.handle(Rule.java:108)

at org.eclipse.jetty.rewrite.handler.HeaderPatternRule$1.handle(HeaderPatternRule.java:89)

at org.eclipse.jetty.rewrite.handler.Rule$Handler.handle(Rule.java:108)

at org.eclipse.jetty.rewrite.handler.RewriteHandler.handle(RewriteHandler.java:143)

at org.eclipse.jetty.server.Handler$Sequence.handle(Handler.java:805)

at org.eclipse.jetty.server.Handler$Sequence.handle(Handler.java:805)

at org.eclipse.jetty.server.Server.handle(Server.java:182)

at org.eclipse.jetty.server.internal.HttpChannelState$HandlerInvoker.run(HttpChannelState.java:721)

at org.eclipse.jetty.server.internal.HttpConnection.onFillable(HttpConnection.java:416)

at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:323)

at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)

at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53)

at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:492)

at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.epcRunTask(AdaptiveExecutionStrategy.java:428)

at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:401)

at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:255)

at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.run(AdaptiveExecutionStrategy.java:204)

at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:311)

at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:981)

at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1212)

at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1166)

at java.base/java.lang.Thread.run(Unknown Source)

Caused by: com.inductiveautomation.ignition.gateway.auth.saml.binding.http.response.SAMLHttpResponseFactoryException: Unable to deserialize the SAML Response XML Document

at com.inductiveautomation.ignition.gateway.auth.saml.binding.http.response.AbstractSAMLHttpResponseFactory.create(AbstractSAMLHttpResponseFactory.java:400)

at com.inductiveautomation.ignition.gateway.auth.idp.saml.SAMLIdentityProvider.parseLoginResponse(SAMLIdentityProvider.java:63)

... 55 common frames omitted

Caused by: com.inductiveautomation.ignition.gateway.auth.saml.serialization.SAMLDeserializerException: Unable to parse the Document

at com.inductiveautomation.ignition.gateway.auth.saml.serialization.AbstractSAMLDeserializer.deserialize(AbstractSAMLDeserializer.java:46)

at com.inductiveautomation.ignition.gateway.auth.saml.binding.http.response.AbstractSAMLHttpResponseFactory.create(AbstractSAMLHttpResponseFactory.java:398)

... 56 common frames omitted

Caused by: com.inductiveautomation.ignition.gateway.auth.saml.parsing.SAMLDocumentParserException: Schema validation failed

at com.inductiveautomation.ignition.gateway.auth.saml.parsing.SchemaValidatingSAMLDocumentParser.validate(SchemaValidatingSAMLDocumentParser.java:77)

at com.inductiveautomation.ignition.gateway.auth.saml.parsing.SchemaValidatingSAMLDocumentParser.parse(SchemaValidatingSAMLDocumentParser.java:93)

at com.inductiveautomation.ignition.gateway.auth.saml.parsing.SAMLDocumentParserDecorator.parse(SAMLDocumentParserDecorator.java:33)

at com.inductiveautomation.ignition.gateway.auth.saml.parsing.IdTaggingSAMLDocumentParserDecorator.parse(IdTaggingSAMLDocumentParserDecorator.java:51)

at com.inductiveautomation.ignition.gateway.auth.saml.serialization.AbstractSAMLDeserializer.deserialize(AbstractSAMLDeserializer.java:44)

... 57 common frames omitted

Caused by: org.xml.sax.SAXParseException: cvc-datatype-valid.1.2.1: '67562b43-afaa-4be2-8548-6334c73310e7' is not a valid value for 'NCName'.

at java.xml/com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(Unknown Source)

at java.xml/com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.error(Unknown Source)

at java.xml/com.sun.org.apache.xerces.internal.impl.XMLErrorReporter.reportError(Unknown Source)

at java.xml/com.sun.org.apache.xerces.internal.impl.XMLErrorReporter.reportError(Unknown Source)

at java.xml/com.sun.org.apache.xerces.internal.impl.XMLErrorReporter.reportError(Unknown Source)

at java.xml/com.sun.org.apache.xerces.internal.impl.xs.XMLSchemaValidator$XSIErrorReporter.reportError(Unknown Source)

at java.xml/com.sun.org.apache.xerces.internal.impl.xs.XMLSchemaValidator.reportSchemaError(Unknown Source)

at java.xml/com.sun.org.apache.xerces.internal.impl.xs.XMLSchemaValidator.processOneAttribute(Unknown Source)

at java.xml/com.sun.org.apache.xerces.internal.impl.xs.XMLSchemaValidator.processAttributes(Unknown Source)

at java.xml/com.sun.org.apache.xerces.internal.impl.xs.XMLSchemaValidator.handleStartElement(Unknown Source)

at java.xml/com.sun.org.apache.xerces.internal.impl.xs.XMLSchemaValidator.startElement(Unknown Source)

at java.xml/com.sun.org.apache.xerces.internal.jaxp.validation.DOMValidatorHelper.beginNode(Unknown Source)

at java.xml/com.sun.org.apache.xerces.internal.jaxp.validation.DOMValidatorHelper.validate(Unknown Source)

at java.xml/com.sun.org.apache.xerces.internal.jaxp.validation.DOMValidatorHelper.validate(Unknown Source)

at java.xml/com.sun.org.apache.xerces.internal.jaxp.validation.ValidatorImpl.validate(Unknown Source)

at java.xml/javax.xml.validation.Validator.validate(Unknown Source)

at com.inductiveautomation.ignition.gateway.auth.saml.parsing.SchemaValidatingSAMLDocumentParser.validate(SchemaValidatingSAMLDocumentParser.java:75)

... 61 common frames omitted

```

I'm using samltest.dev to do some initial trials in case this helps.

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [October 1, 2026, 6:28pm UTC](https://forum.inductiveautomation.com/t/examples-for-setting-up-saml-idp-profiles/25112/10 "2026-10-01T18:28:02Z")

</div>

The identity provider (IdP) is sending a SAML Response that breaks the SAML 2.0 schema. Ignition always validates the response against that schema, so it rejects it.

What's wrong: the IdP put a bare UUID, 67562b43-afaa-4be2-8548-6334c73310e7, in an ID attribute, most likely \<samlp:Response ID="..."\> or \<saml:Assertion ID="..."\>. The SAML schema types those attributes as xs:ID, which must be a valid XML NCName. An NCName can't start with a digit; it has to start with a letter or \_. A UUID that starts with 6 fails, so Xerces (XML library Ignition uses) throws cvc-datatype-valid.1.2.1. Everything above that in the trace is just wrapper exceptions.

How to fix it: change the IdP so it generates valid IDs. Most IdPs do this by default with a prefix, such as \_ (ADFS, Entra ID) or ID\_ (Keycloak). This one is emitting raw UUIDs, so it's either custom-built or misconfigured. To confirm which element is at fault, capture the raw response with a browser SAML tracer and look for ID="67562b43-...".

---

<div class="post-metadata">

**Author:** ![imt.sebastian.sanche](https://avatars.discourse-cdn.com/v4/letter/i/ecb155/32.png) [@imt.sebastian.sanche](https://forum.inductiveautomation.com/u/imt.sebastian.sanche)\
**Post date:** [October 1, 2026, 6:42pm UTC](https://forum.inductiveautomation.com/t/examples-for-setting-up-saml-idp-profiles/25112/11 "2026-10-01T18:42:17Z")

</div>

So basically when I saw it work the start aligned. Thanks!