A customer was working fine and then within a short space of time Dev, QA and Production all stopped working for a Java SAML SaaS product with the error:
Microsoft.IdentityModel.Protocols.XmlSignature.SignatureVerificationFailedException: MSIS0038: SAML Message has wrong signature. Issuer: 'xxx'.
Back in the day, there was a bug in ADFS that produced this error but it was misleading - it had nothing to do with certificates. But I could find no reference to a new bug.
Coincidentally, the ADFS certificates rolled around the same time.
That's where we put our effort and nothing helped. We turned rollover off and on, we used the "urgent" construct to force new certificates etc.
Nothing doing :-(
In desperation, I asked the supplier to send us the contents of the key store.
Then I noticed that the thumbprint of their signing certificate didn't match the one in ADFS,
This certificate expires in 2026. Why on earth did in change?
So I did some digging. Turns out this was the "new kid on the block" syndrome. The guru who normally did this had left and they gave the job to a newbie.
He looked at the document he was given but did not realise that this was "as-built" not "deployment".
So every time he built a new build, he changed the signing certificate. He didn't supply it to ADFS.
That's why the error progressively rolled. The company wanted a fix and as the deployment rolled through the various environments, it broke.
Sometimes, you have to look outside of the square.
Again, best practice and supplying metadata would have helped.
To quote Sherlock Holmes:
"When you have eliminated the impossible, whatever remains, however improbable, must be the truth".
Enjoy!
No comments:
Post a Comment