SAML 2.0 requests fails on identity provider due to signing certificate mismatch

SAML 2.0 requests fails on identity provider due to signing certificate mismatch

book

Article ID: CTX464062

calendar_today

Updated On:

Description

When opening citrix cloud workspace URL for authentication, page redirects to accounts.cloud.com/core/error URL with error : Unable to Process Your Request : There was an unexpected error 
Transaction ID : xxxxx

Resolution

  • Configure the identity provider to automatically fetch the certificate used for signing SAML requests from citrix metadata . This will ensure service continuity even when there is a change in signing certificate from citrix .
  • Metadata document can be obtained from SAML configuration page on citrix cloud console or from the following URL https://saml.cloud.com/saml/metadata 
  • To find which citrix public key is used for signing certificate used in SAML request to the IDP , SAML tracer extension can be used in google chrome.

Problem Cause

  • Citrix changes the certificate used for singing the SAML requests periodically when it is about to expire or due to other security reasons.
  • SAML IDP should be configured correctly to automatically fetch the certificate key from the citrix metadata for SAML 2.0