Splunk Enterprise

What is this Azure SAML request error AADSTS7500529?

agrandville
Explorer

Hi all,

I'm configuring Splunk (Docker image 8.1.0) to make SAML authentication on Azure ADFS.

Despite all looks right, I get this error in response to the Splunk SAML Request

SAMLRequestError.png

 

 

 

 

 

 

 

 

 

'AADSTS7500529: The value '1a480d8dd87f.4.DA3C17FD-8DE5-4E39-8F52-5EF91CD63A51' is not a valid SAML ID. The ID must not begin with a number.'

I guess a problem with the ID's format of <samlp:AuthnRequest>, let me show you the content of my SAML requests

 

 

<samlp:AuthnRequest xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="1a480d8dd87f.3.DA3C17FD-8DE5-4E39-8F52-5EF91CD63A51" 

 

 

Whereas Microsoft SAML 2.0 protocol documentation  impose a specific format for it

ID Required Azure AD uses this attribute to populate the InResponseTo attribute of the returned response. ID must not begin with a number, so a common strategy is to prepend a string like "id" to the string representation of a GUID. For example, id6c1c178c166d486687be4aaf5e482730 is a valid ID.

 

Do you confirm this is a malfunction ?

Thank's

Arnaud

Labels (2)
Tags (2)
0 Karma

jorks
New Member

I just worked my way through this issue. 

The SAML ID is prefixed with the hostname of the docker container. Which in my case was auto-generated starting with a number. When I consoled into my container and ran cat /etc/hostname I could see the mysterious number that was breaking my SAML auth with:

'AADSTS7500529: The value '1a480d8dd87f.4.DA3C17FD-8DE5-4E39-8F52-5EF91CD63A51' is not a valid SAML ID. The ID must not begin with a number.'

Where 1a480d8dd87f was my container hostname.

I re-deployed my docker stack with:

services:
splunk:
image: ${SPLUNK_IMAGE:-splunk/splunk:latest}
container_name: splunk
hostname: splunk
...

And my SAML began to work:

ID="splunk.2.DA3C17FD-8DE5-4E39-8F52-5EF91CD63A51"

Hope this helps someone in the future 🙂 

~ James

Tags (3)
0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...