Splunk Enterprise

Verification of SAML assertion using the IDP's certificate provided failed

tlam_splunk
Splunk Employee
Splunk Employee

Find that the portal SSO is not working. It returns the error of the verification of the signature in the certificate idpCert.pem after renewal.
It's because in ADFS has ONE certificate originally , but the certificate will be expired next week, so one month before, ADFS will have one more certificate generated automatically and put it as secondary. Then two weeks before expiry, it will change the new certificate as the Primary and the old certificate as the secondary automatically. Later, the 2nd one will be removed from ADFS. That’s the way working in AFDS. that’s we see TWO certificates now.

We try to regenerate the metadata from the ADFS like the originally configuration
(simiar steps as http://blogs.splunk.com/2016/09/14/configuring-microsofts-adfs-splunk-cloud/)
And try to import the new xml (federationmetadata.xml) into the SAML configuration in the Splunk
It encounters the error “There are multiple cert,idepCertPath,idpCert.pem, must be directory"
Try to remove the idpCert.pem in the ./etc/auth/idpCerts/idpCert.pem.
And then re-import the metadata again but it encounters the “Sever Error”

Any way to fix it.

Tags (1)
0 Karma

tlam_splunk
Splunk Employee
Splunk Employee

Find a way to fix it.


Update the idpCert.pem file after the ADFS certificate is updated

  • Generation of the federationmedata.xml from ADFS
  • Open the xml file by the xml viewer
  • Find the X509Data -> X509Certificate
  • Backup the idpCert.pem and create a new one

-----BEGIN CERTIFICATE-----
< content of the X509 Certificate>
-----END CERTIFICATE-----


0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...