Forum Discussion

kj07208_118528's avatar
kj07208_118528
Icon for Cirrus rankCirrus
Feb 26, 2014

Error in SAML - Unable to find SAML SSO/SP Connector object matching SAML Authn Request

Feb 26 13:13:15 err tmm2[14202]: 014d0002:3: 8aab4afd: SSOv2 Error: No SP Connector attached to SAML SSO from assigned SAML resources matching authentication request. If ACS URL is present in authentication request it should match ACS URL from SP Connector. If Issuer is present in authentication request it should match entity_id from SP connector. Feb 26 13:13:15 err tmm2[14202]: 014d0002:3: 8aab4afd: SSOv2 Error(16) Unable to find SAML SSO/SP Connector object matching SAML Authn Request

 

It seems like everything matches up but I keep getting this error. I have checked the following:

 

AssertionConsumerServiceURL

 

Sent by SP http://somedomain.com/techy-test/wp-content/plugins/saml-20-single-sign-on/saml/www/module.php/saml/sp/saml2-acs.php/1" F5 ACS http://somedomain.com/techy-test/wp-content/plugins/saml-20-single-sign-on/saml/www/module.php/saml/sp/saml2-acs.php/1

 

Issuer ID

 

Sent by SP http://somedomain.com/techy-test/wp-content/plugins/saml-20-single-sign-on/saml/www/module.php/saml/sp/metadata.php/1 F5 SP Entity ID http://somedomain.com/techy-test/wp-content/plugins/saml-20-single-sign-on/saml/www/module.php/saml/sp/metadata.php/1

 

This data is from the APM logs so what other piece of information is it trying to match to determine the correct SP Connector?

 

BIG-IP Access Policy Manager (APM)
security
  • kj07208_118528's avatar
    kj07208_118528
    Icon for Cirrus rankCirrus
    Feb 27, 2014

    Found the issue (I needed to read the log more carefully) it turned out that I didn't have a SAML resource and I didn't have a resource on the webtop either. Error tends to be misleading but read as much as the log as you can.

     

    • Juraj's avatar
      Juraj
      Icon for Cirrus rankCirrus
      Jun 09, 2018

      Trying to solve the same problem. I'd like to show a webpage to our clients with some error message, instead of just the TCP reset they get now.

       

      • brad_hanson's avatar
        brad_hanson
        Icon for Nimbostratus rankNimbostratus
        Jun 24, 2019

        any solution.. right. the APM shouldn't just stop and 'crash' the user it should provide for a graceful exit and message to the customer. The TCP reset is an indication of a condition that isn't being handled correctly by APM. Hoping you found a solution.

    • Przemyslaw_Wyr1's avatar
      Przemyslaw_Wyr1
      Icon for Altocumulus rankAltocumulus
      Sep 18, 2015
      I would like to receive any response in this situation beside reset connection - is there any chance to do that ? I have configured different webtops for few types of users ( client, partner ... ect ) - each of them has group of resources on own webtop and if some resource isn't attached because it has to be, what to do to not get reset connection in this situation ?