Saml2: The Saml2Response must have status success to extract claims. Status: Responder.

[FerdyHoefakker]

Hi,

I've been trying to set up a SAML connection with the ADFS of one our clients. However, I keep getting the error mentioned in the title. I've been in contact with their IT department and they say everything is fine on their end (none of the other SP's are having this issue).

I have installed the SAML tracer plugin for Chrome and it returns data, but nothing that I can personally see that points to what is going wrong.

The response:

<samlp:Response Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified"
    Destination="https://desitnationurl/AuthServices/Acs" ID="_a36c641f-1f1f-4a14-94a3-c507a78c7860"
    InResponseTo="id6a337f4e37ba4d4d8d632cad66bf4fa5" IssueInstant="2017-01-18T07:51:59.005Z"
    Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">http://idpurl/adfs/services/trust</Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
            <ds:Reference URI="#_a36c641f-1f1f-4a14-94a3-c507a78c7860">
                <ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                <ds:DigestValue>...</ds:DigestValue>
            </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>...</ds:SignatureValue>
        <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
            <ds:X509Data>
                <ds:X509Certificate>...</ds:X509Certificate>
            </ds:X509Data>
        </KeyInfo>
    </ds:Signature>
    <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"/></samlp:Status>
</samlp:Response>

Considdering their other SAML sp's are not having problems, I am assuming the problem is in my configuration somewhere. But I don't know what I am missing.

I added the configSections according to the documentation

<configSections>
    <!-- Add these sections below any existing. -->
    <section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
    <section name="system.identityModel.services" type="System.IdentityModel.Services.Configuration.SystemIdentityModelServicesSection, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
    <section name="kentor.authServices" type="Kentor.AuthServices.Configuration.KentorAuthServicesSection, Kentor.AuthServices"/>
  </configSections>

As well as the kentor.authServices:

<kentor.authServices entityId="https://oururl/AuthServices/" returnUrl="https://oururl/" authenticateRequestSigningBehavior="Always">
    <!--<nameIdPolicy allowCreate="true" format="Persistent"/>-->
    <metadata cacheDuration="0:0:42" validDuration="7.12:00:00" wantAssertionsSigned="true">
      <organization name="Perplex Internetmarketing B.V." displayName="Perplex" url="https://www.perplex.nl" language="nl" />
      <contactPerson type="Other" email="[email protected]" />
      <!--<requestedAttributes>
        <add friendlyName ="Some Name" name="urn:someName" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" isRequired="true" />
        <add name="Minimal" />
      </requestedAttributes>-->
    </metadata>
    <identityProviders>
      <add entityId="http://idpurl/adfs/services/trust" 
           metadataLocation="/App_Data/idpmetadeta.xml" 
           signOnUrl="https://idpurl/adfs/ls/" 
           allowUnsolicitedAuthnResponse="true" 
           binding="HttpPost" 
           wantAuthnRequestsSigned="true">
        <signingCertificate fileName="~/App_Data/idpcertificate.cer" />        
      </add>
    </identityProviders>
    <!-- Optional configuration for signed requests. Required for Single Logout. -->
    <serviceCertificates>
      <add storeName="AddressBook" storeLocation="LocalMachine" findValue="thumbprint" x509FindType="FindByThumbprint" use="Signing" />

    </serviceCertificates>
    <!-- Optional configuration for fetching IDP list from a federation -->
  </kentor.authServices>

The metadata generated:

<EntityDescriptor ID="_c1a85d4c-f56a-4cd6-a532-ef79fda60f36" entityID="https://oururl/AuthServices/" cacheDuration="PT42S" validUntil="2017-01-25T20:08:34Z" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
    <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
        <SignedInfo>
            <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
            <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
            <Reference URI="#_c1a85d4c-f56a-4cd6-a532-ef79fda60f36">
                <Transforms>
                    <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
                    <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                </Transforms>
                <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
                <DigestValue>...</DigestValue>
            </Reference>
        </SignedInfo>
        <SignatureValue>...</SignatureValue>
        <KeyInfo>
            <X509Data>
                <X509Certificate>...</X509Certificate>
            </X509Data>
        </KeyInfo>
    </Signature>
    <SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <KeyDescriptor use="signing">
            <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
                <X509Data>
                    <X509Certificate>...</X509Certificate>
                </X509Data>
            </KeyInfo>
        </KeyDescriptor>
        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://oururl/AuthServices/Logout" />
        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://oururl/AuthServices/Logout" />
        <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://oururl/AuthServices/Acs" index="0" isDefault="true" />
        <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://oururl/AuthServices/Acs" index="1" isDefault="false" />
    </SPSSODescriptor>
    <Organization>
        <OrganizationName xml:lang="nl">Perplex Internetmarketing B.V.</OrganizationName>
        <OrganizationDisplayName xml:lang="nl">Perplex</OrganizationDisplayName>
        <OrganizationURL xml:lang="nl">https://www.perplex.nl/</OrganizationURL>
    </Organization>
    <ContactPerson contactType="other">
        <EmailAddress>[email protected]</EmailAddress>
    </ContactPerson>
</EntityDescriptor>

Obviously I obscured some urls and values.

I must be missing something, but I have no clue as to what it is so any help would be appreciated.

Kind regards,

-Ferdy

[AndersAbel]

The Responder status means that the Idp has encountered an error. If the Idp thought it was AuthServices' fault it would have set the status to Requester. So it looks like something went wrong on their end. Check if you can get any logs from the Idp (ADFS Server).

[FerdyHoefakker]

Hi Anders,

thanks for the reply. I have contacted them and we did some testing. The ADFS is not logging any authentication attempts when attempting a login initiated from the SP (us). There is multifactor authentication involved and that DOES log an authentication attempt.

Oh, extra detail. The ADFS is running version 3 in case this matters.

Kind regards,

-Ferdy

[FlorenceDaniel]

Hi FerdyHoefakker,

I am facing the same issue as you. ADFS 3.0 sends a SAML Response with Status code as "Responder".
It would be helpful if you let us know you resolved this issue, finally.

Thanks!
Florence

[AndersAbel]

@FlorenceDaniel Check the ADFS logs, it will show up there. You might have to turn on extra ADFS logging (done in event viewer).

[FlorenceDaniel]

Hi Anders,

We are not the IDP. We dont have access to ADFS logs. Guess we just have to leave it to our IDP to identify and resolve the issue.

Thanks!
Florence

[AndersAbel]

@FlorenceDaniel Yes, if the IDP is operated by a separate party you have to leave it to them. The status code "Responder" indicates that something is wrong on their end.

[FlorenceDaniel]

Thank you!

On Tue, Jan 9, 2018 at 2:26 AM, Anders Abel [e-mail]
wrote:

@FlorenceDaniel https://github.com/florencedaniel Yes, if the IDP is
operated by a separate party you have to leave it to them. The status code
"Responder" indicates that something is wrong on their end.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/Sustainsys/Saml2/issues/632#issuecomment-356201573,
or mute the thread
https://github.com/notifications/unsubscribe-auth/Ahmvi6JDMn_xKCF2Kmde8uudtMBzOqt1ks5tIxS3gaJpZM4LmlwN
.

[suvarnajayanth]

Hi @FlorenceDaniel
Am facing same issue , did you find luck on this ?

[suvarnajayanth]

Am able to fix this by changing the Algorithm to SHA-256

[minicuper]

Am able to fix this by changing the Algorithm to SHA-256

where? in the initial samlp:AuthnRequest ?

[suvarnajayanth]

Hi Guys ,
Response which i was getting 'Status: Responder' due to Security Algorithm mismatch between client side & my Saml application . My SAML application was using SHA-1 algorithm by default . Which i changed to SHA-256

[uzumaki98]

How did you change the signin algo to SHA-256