Firstly, I would like to thank you for the detailed documentation of SAML integration with multiple Identity providers.
I’m new to SAML and started exploring the examples to evaluate the trail version. I was able to run the application with the following Identity Providers configured separately:
1. Okta
2. ADFS
But, after combining both the configurations to saml.config, it returned the following exception:
Error: Multiple partner identity providers are configured so the partner identity provider name must be specified.
Configuration -
saml.config:
<ServiceProvider Name=“<a href=“https://MvcExampleServiceProvider” “=”” style=“”><a href=“https://MvcExampleServiceProvider” “=”“><a href=“https://MvcExampleServiceProvider” “=””><a href=“https://MvcExampleServiceProvider”“>https://MvcExampleServiceProvider”
Description=“MVC Example Service Provider”
AssertionConsumerServiceUrl=“~/SAML/AssertionConsumerService”
LocalCertificateFile=“Certificates\sp.pfx”
LocalCertificatePassword=“password”/>
<PartnerIdentityProvider Name=“<a href=“http://…” “=”” style=“”><a href=“http://…” “=”“><a href=“http://…” “=””><a href=“http://…”“>http://…”
Description=“IdP 1”
SignAuthnRequest=“true”
SignLogoutRequest=“true”
SignLogoutResponse=“true”
SingleSignOnServiceUrl=“…”
SingleLogoutServiceUrl=“…”
PartnerCertificateFile=“Certificates.…cert”/> →
<PartnerIdentityProvider Name=“<a href=“http://…/adfs/services/trust” “=”” style=“”><a href=“http://…/adfs/services/trust” “=”“><a href=“http://…/adfs/services/trust” “=””><a href=“http://…/adfs/services/trust”“>http://…/adfs/services/trust”
Description=“IdP 2”
SignAuthnRequest=“true”
SignLogoutRequest=“true”
SignLogoutResponse=“true”
WantAssertionEncrypted=“true”
WantLogoutResponseSigned=“true”
SingleSignOnServiceUrl=“<a href=“https://…/adfs/ls/” “=”” style=“”><a href=“https://…/adfs/ls/” “=”“><a href=“https://…/adfs/ls/” “=””><a href=“https://…/adfs/ls/”“>https://…/adfs/ls/”
SingleLogoutServiceUrl=“<a href=“https://…/adfs/ls/” “=”” style=“”><a href=“https://…/adfs/ls/” “=”“><a href=“https://…/adfs/ls/” “=””><a href=“https://…/adfs/ls/”“>https://…/adfs/ls/”
PartnerCertificateFile=“Certificates.…cer”/>
web.config:
<add key=“PartnerName” value=“<a href=“http://…” “=”” style=“”><a href=“http://…” “=”" style=“”><a href=“http://…” “=”" style=“”><a href=“http://…”“>http://…” />
Trace log:
Exception: ComponentSpace.SAML2.Exceptions.SAMLConfigurationException: Multiple partner identity providers are configured so the partner identity provider name must be specified.
at ComponentSpace.SAML2.Configuration.Resolver.SAMLConfigurationResolver.GetPartnerIdentityProviderConfiguration(String configurationID, String partnerName)
at ComponentSpace.SAML2.InternalSAMLServiceProvider.GetPartnerIdentityProviderConfiguration(String partnerName)
at ComponentSpace.SAML2.InternalSAMLServiceProvider.InitiateSSO(HttpResponseBase httpResponse, String relayState, String partnerIdP, SSOOptions ssoOptions, String assertionConsumerServiceUrl, String singleSignOnServiceUrl)
at ComponentSpace.SAML2.SAMLServiceProvider.InitiateSSO(HttpResponseBase httpResponse, String relayState, String partnerIdP)
at …Controllers.SamlController.InitiateSingleSignOn(String returnUrl)
Could you please help me fix this issue.
Thanks,
Bhargav
Hi Bhargav
Thank you for your kind words.
If there are multiple entries in your saml.config and you call SAMLServiceProvider.InitiateSSO, you need to specify the name of the to which you wish to initiate SSO.
This is the partnerName parameter to the SAMLServiceProvider.InitiateSSO call.
In our example projects, we use the PartnerName in web.config.
However, you would probably use a different mechanism in a production environment.
Please ensure you’re setting the partnerName parameter.
[quote][/quote]
Hi Bhargav
Thank you for your kind words.
If there are multiple entries in your saml.config and you call SAMLServiceProvider.InitiateSSO, you need to specify the name of the to which you wish to initiate SSO.
This is the partnerName parameter to the SAMLServiceProvider.InitiateSSO call.
In our example projects, we use the PartnerName in web.config.
However, you would probably use a different mechanism in a production environment.
Please ensure you're setting the partnerName parameter.
Thank you for your kind words.
If there are multiple entries in your saml.config and you call SAMLServiceProvider.InitiateSSO, you need to specify the name of the to which you wish to initiate SSO.
This is the partnerName parameter to the SAMLServiceProvider.InitiateSSO call.
In our example projects, we use the PartnerName in web.config.
However, you would probably use a different mechanism in a production environment.
Please ensure you're setting the partnerName parameter.
Thanks for the response. I had the partnerName key set in web.config and also the call to SAMLServiceProvider.InitiateSSO in SamlController.cs file. But, it still throws the same error.
Any other configuration need to be done ?
No, That’s all.
I suggest setting a breakpoint on the call to SAMLServiceProvider.InitiateSSO to check that the partnerName is not null.
[quote]
[/quote]
Thanks !!
It worked after I changed the key from partnerName -> partnerIdP in web.config and calling the SAMLServiceProvider.InitiateSSO(response, returnUrl, partnerIdP). Not sure why it didn't work with the partnerName key even though it was not returning null value when I put a break point in debug mode.
You’re welcome.