SP-Initiated POST request results in 400 Error

Document ID : KB000037629
Last Modified Date : 09/11/2018
Show Technical Document Details
Introduction:

Problem:

When attempting SP-initiated POST request, user is receiving 400 error.  The following is written to the FWSTrace.log:

 

Transaction with ID: 2b474df9-cc268318-a53293bf-1b3bb99d-7e444b1a-eb failed. Reason: NO_SAML_REQUEST_OR_SPID

No SAMLRequest or SPID parameter in request to SAML2 Single Sign-On Service

 

Ending SAML2 Single Sign-On Service request processing with HTTP error 400

 

Environment:

Siteminder Federation R12.52 and higher, all platforms (prior to version 12.52, only the redirect binding was supported for SP-initiated requests; SP-initiated requests via POST were not supported until R12.52) .

 

Cause:

Assuming the SAMLRequest parameter included in the POST data is properly formatted and contains the expected data, this error is most often caused by not having the Policy Server's session store enabled.  When an unauthenticated user submits an SP-Initiated POST request, the Policy Server needs a mechanism for holding the post data during the series of redirects that occur during authentication.  The policy server requires the session store for this (please note that persistent sessions are not required for this use case; enabling the session store is sufficient).  Without the session store enabled, the POST data is lost during authentication, and thus when the user returns to the saml2sso URL, it is now a GET request and the query sting looks similar to this:

SMASSERTIONREF=QUERY&SAMLTRANSACTIONID=432ef752-62ed604b-5494401a-6de5813d-7f35e66c-8

This problem can also occur if a valid session cookie is not presented upon return to saml2sso after authentication. Such a scenario can occur if the authentication URL and saml2sso are not in the same cookie domain, or if flags are set on the session cookie such that the browser will not present the cookie to the saml2sso URL.  The same error as above will occur, caused by the request URL not containing sufficient information to determine the proper Authentication URL.

Note that this problem will not occur for an authenticated user who submits an SP-initiated POST request.  This is because the saml2sso URL can process the POST data immediately without redirecting the user for authentication.

 

 

 

Resolution:

Configure and enable the session store on the policy server (this is done in the Policy Server Management Console on the Data tab and does require a restart of the Policy Server to take effect).

 

Workaround:

If a session store cannot be enabled for any reason, the only workaround is to only allow the redirect binding for SP-initiated requests.  This moves the SAMLRequest parameter to the URL and does not require the session store to be enabled.

Instructions:
Please Update This Required Field