| Trouble shooting Single Sign Out |  |
| The Web UI supports a “Sign Off “command (top right button in the framework). Running this command can cause the following errors. Logout request not signed After the sign out command is given from the Web UI, this error page displays: The event viewer on the ADFS server contains the following event:
    The verification of the SAML message signature failed.

    Message issuer: fedlet_wriphage

    Exception details:

    MSIS1014: SAML LogoutRequest and LogoutResponse messages must be signed when using SAML
    HTTP Redirect or HTTP POST binding.
Possible reasons: idp-extended.xml does not contain: "wantLogoutReqeustSigned" attribute The event viewer on the ADFS server contains the following event:
    The Federation Service encountered an error while processing the SAML authentication
    request.

    Additional Data

    Exception details:
    Microsoft.IdentityModel.Protocols.XmlSignature.SignatureVerificationFailedException:
    MSIS0037: No signature verification
    certificate found for issuer 'fedlet_wriphage'.

       at
    Microsoft.IdentityServer.Protocols.Saml.Contract.SamlContractUtility.CreateSamlMessage
    (MSISSamlBindingMessage message)

       at
    Microsoft.IdentityServer.Service.SamlProtocol.SamlProtocolService.Logout(LogoutRequest
    logoutRequest)

       at
    Microsoft.IdentityServer.Service.SamlProtocol.SamlProtocolService.ProcessRequest(Message
    requestMessage)
Possible reasons: The Signature used by the Web UI for signing the logout request was not added to trusted party in ADFS The event viewer on the ADFS server contains the following event:
    SAML request is not signed with expected signature algorithm. SAML request is signed with
     signature algorithm
    http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 . Expected signature algorithm is
    http://www.w3.org/2000/09/xmldsig#rsa-sha1

    User Action:

    Verify that signature algorithm for the partner is configured as expected.
Possible reasons: Secure hash algorithm for relying trust party not set to SHA-1 in ADFS Failed to create logout request Afther the sign out command is given from the Web UI, this error page displays: The file libSAML which can be found in directory: debug on the fedlet configuration directory, contains the following lines:
    libSAML:10/14/2010 01:29:43:123 PM CEST: Thread[http-8443-Processor25,5,main]

    ERROR: mapPk2Cert.JKSKeyProvider:

    java.io.FileNotFoundException: C:\Data\webuiconfig\fedlet\conf\keystore.jks (The system
    cannot find the file specified)
Possible reasons: Keystore not configured correctly in the FederationConfig.properties When the libSAML file contains the following lines:
    libSAML:10/14/2010 01:39:16:047 PM CEST: Thread[http-8443-Processor25,5,main]

    ERROR: mapPk2Cert.JKSKeyProvider:

    java.io.IOException: Keystore was tampered with, or password was incorrect

    	at sun.security.provider.JavaKeyStore.engineLoad(Unknown Source)
Possible reasons: The password in the .storepass file in the Fedlet conf directory does not contain a password which matches with the password for the related keystore file. The file libSAML2 which can also be found in directory: debug on the fedlet configuration directory, contains these lines:
    ERROR: Incorrect configuration for Signing Certificate.

    libSAML2:10/14/2010 01:46:46:996 PM CEST: Thread[http-8443-Processor24,5,main]

    ERROR: Exception :

    com.sun.identity.saml2.common.SAML2Exception: Error retrieving meta data.

    	at
    com.sun.identity.saml2.common.SAML2Utils.signQueryString(Unknown Source)

    	at
    com.sun.identity.saml2.profile.LogoutUtil.doSLOByHttpRedirect(Unknown Source)

    	at
    com.sun.identity.saml2.profile.LogoutUtil.doLogout(Unknown Source)
Possible reasons: The configuration file: sp-extended.xml does not contain correct value for: signingCertAlias attribute. This must be the alias of the key-pair in the keystore file which is used for signing the logout request. |