Identity provider SAML issue

Hello,

I am experiencing an issue. I set up Azure identity provider SSO. I went into the ignition project and selected the identity provider there. I am using HTTPS, TSL cert, etc.

When I go to the URL perspective session it brings up the Ignition log in screen. I can click on it, it then redirects me to the azure log in. When I enter my user and pass into there it then just redirects me back to the same log in ignition default screen and never takes me to the project page I wish. It seems to be stuck in a log in loop?

Any thoughts on how or what I need to do in order for the Idp log in to take me past the log in screen and redirect me to the main project page?

Also, when I go to test login from the identity provider page on the configuration it comes back with no idp response data. I have looked at the logs and just shows not parsed. I have looked at the forums and reached out to customer support, but have no solution yet.

I fixed the same issue on my gateway changing the Issuer in the IdP settings.

On this log page you pasted here, scroll down to the line "Caused by...".
At the end of the page you will find the message:

claim value (https://login.microsoftonline.com/{some number}/v2.0) doesn't match expected value of https://login.microsoftonline.com/{tenantid}/v2.0]

Copy the https://login.microsoftonline.com/{some number}/v2.0, paste it into the Issuer field, and save the settings.

OMG! Thank you so much for helping with this!! It worked :slight_smile:

You're welcome.

Hi Augusto,

I am running into a very similar issue however I do not find the string "claim value ...". Is there perhaps maybe something that I am missing? Below there is a copy of my error log:

Thank you very much for your support!

Hi David,

It looks like the configuration in the idP is incorrect. Are you using Open Connect or SAML?
The error log points to the issue on your provider's XML response file.

Did you follow these instructions?
Configuring Identity Providers | Ignition User Manual (inductiveautomation.com)

Hi Augusto,

Thank you very much for your reply. We are using SAML and yes we followed the instructions as described in the link above. The website asks us to authenticate and we succesfully autenticate but the website ask us to sign in again, staying in sort of a loop.

In this case, you have Validate Response Signatures checkbox enabled on your SAML IdP (Ignition config settings) but your IdP is not signing the Response.

Usually SAML IdPs sign either the Response or the Assertions. Check to see which one your IdP signs and then enable the appropriate checkbox in the Ignition SAML IdP's settings.

1 Like

Thank you very much. This solved it, I had to select assertions. Thank you.

1 Like