Splunk Enterprise

Verification of SAML assertion using the IDP's certificate provided failed

Splunk Employee
Splunk Employee

Find that the portal SSO is not working. It returns the error of the verification of the signature in the certificate idpCert.pem after renewal.
It's because in ADFS has ONE certificate originally , but the certificate will be expired next week, so one month before, ADFS will have one more certificate generated automatically and put it as secondary. Then two weeks before expiry, it will change the new certificate as the Primary and the old certificate as the secondary automatically. Later, the 2nd one will be removed from ADFS. That’s the way working in AFDS. that’s we see TWO certificates now.

We try to regenerate the metadata from the ADFS like the originally configuration
(simiar steps as http://blogs.splunk.com/2016/09/14/configuring-microsofts-adfs-splunk-cloud/)
And try to import the new xml (federationmetadata.xml) into the SAML configuration in the Splunk
It encounters the error “There are multiple cert,idepCertPath,idpCert.pem, must be directory"
Try to remove the idpCert.pem in the ./etc/auth/idpCerts/idpCert.pem.
And then re-import the metadata again but it encounters the “Sever Error”

Any way to fix it.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Find a way to fix it.

Update the idpCert.pem file after the ADFS certificate is updated

  • Generation of the federationmedata.xml from ADFS
  • Open the xml file by the xml viewer
  • Find the X509Data -> X509Certificate
  • Backup the idpCert.pem and create a new one

< content of the X509 Certificate>

0 Karma
Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out &gt;&gt; Kudos to all the ...