SAML WebSSO SHA1 issue with ADFS
Hi,
I am trying to configure Desktop SSO between Pega(SP) and ADFS(IDP) but getting the following error:
Unable to process the SAML WebSSO request : The Response did not contain any Authentication Statement that matched the Subject Confirmation criteria
I can see in the logs that the SAML Web SSO Authentication Activity (Step: AuthService.pySAMLWebSSO) is generating a SAML request with a SHA1 signature:
Generated authentication request : <saml2p:AuthnRequest....<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
But ADFS is generating a SHA256 signature method response.
Is there any way to configure Pega such that it uses a "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" signature method algorithm?
The method samlutils.createAuthenticationRequest passes in a Data-Admin-Security-SSO-SAML class type, but there is no property to set the signature method algorithm.
Thanks,
Bill
***Updated by moderator: Lochan to tag SR to post***
Accepted Solution
Pegasystems Inc.
US
Upon reviewing the associated SR, SA-55228 was generated as the resolution.
If you have the same question, please check out "ADFS does not recognize Pega SAML request signature" to resolve this for you.
Pegasystems Inc.
IN
Hi,
I don't think there is a way to change the signature algorithm. Can you please share your pega platform version details ?
Regards,
Santhosh
Department of Environment
AU
We are on Pega Cloud 7.3.1. There is a bug in the product. We got this response from Pega:
Here is an existing hotfix-42004 as DL-83609.
Made required code changes in sign() method of SAMLPostBindingHandler.java.
previously signature algorithm was hard coded. Now we we get signature algorithm from SP certificate.
(Please use RSA-SHA256 algorithm for SP certificate)
Please install the DL file by hotfix manager and restart is required.
However, this has only partially resolved the issue. We also need a fix for the logout request. Currently with Pega support. Will post the update when I hear back from them.
Accepted Solution
Pegasystems Inc.
US
Upon reviewing the associated SR, SA-55228 was generated as the resolution.
If you have the same question, please check out "ADFS does not recognize Pega SAML request signature" to resolve this for you.