SAML 2.0 requests fails on identity provider due to signing certificate mismatch
book
Article ID: CTX464062
calendar_today
Updated On:
Description
When opening citrix cloud workspace URL for authentication, page redirects to accounts.cloud.com/core/error URL with error : Unable to Process Your Request : There was an unexpected error
Transaction ID : xxxxx
Resolution
- Configure the identity provider to automatically fetch the certificate used for signing SAML requests from citrix metadata . This will ensure service continuity even when there is a change in signing certificate from citrix .
- Metadata document can be obtained from SAML configuration page on citrix cloud console or from the following URL https://saml.cloud.com/saml/metadata
- To find which citrix public key is used for signing certificate used in SAML request to the IDP , SAML tracer extension can be used in google chrome.
Problem Cause
- Citrix changes the certificate used for singing the SAML requests periodically when it is about to expire or due to other security reasons.
- SAML IDP should be configured correctly to automatically fetch the certificate key from the citrix metadata for SAML 2.0
Was this article helpful?
thumb_up
Yes
thumb_down
No