Splunk Enterprise

What is this Azure SAML request error AADSTS7500529?

agrandville
Explorer

Hi all,

I'm configuring Splunk (Docker image 8.1.0) to make SAML authentication on Azure ADFS.

Despite all looks right, I get this error in response to the Splunk SAML Request

SAMLRequestError.png

 

 

 

 

 

 

 

 

 

'AADSTS7500529: The value '1a480d8dd87f.4.DA3C17FD-8DE5-4E39-8F52-5EF91CD63A51' is not a valid SAML ID. The ID must not begin with a number.'

I guess a problem with the ID's format of <samlp:AuthnRequest>, let me show you the content of my SAML requests

 

 

<samlp:AuthnRequest xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="1a480d8dd87f.3.DA3C17FD-8DE5-4E39-8F52-5EF91CD63A51" 

 

 

Whereas Microsoft SAML 2.0 protocol documentation  impose a specific format for it

ID Required Azure AD uses this attribute to populate the InResponseTo attribute of the returned response. ID must not begin with a number, so a common strategy is to prepend a string like "id" to the string representation of a GUID. For example, id6c1c178c166d486687be4aaf5e482730 is a valid ID.

 

Do you confirm this is a malfunction ?

Thank's

Arnaud

Labels (2)
Tags (2)
0 Karma

jorks
New Member

I just worked my way through this issue. 

The SAML ID is prefixed with the hostname of the docker container. Which in my case was auto-generated starting with a number. When I consoled into my container and ran cat /etc/hostname I could see the mysterious number that was breaking my SAML auth with:

'AADSTS7500529: The value '1a480d8dd87f.4.DA3C17FD-8DE5-4E39-8F52-5EF91CD63A51' is not a valid SAML ID. The ID must not begin with a number.'

Where 1a480d8dd87f was my container hostname.

I re-deployed my docker stack with:

services:
splunk:
image: ${SPLUNK_IMAGE:-splunk/splunk:latest}
container_name: splunk
hostname: splunk
...

And my SAML began to work:

ID="splunk.2.DA3C17FD-8DE5-4E39-8F52-5EF91CD63A51"

Hope this helps someone in the future 🙂 

~ James

Tags (3)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...