Aruba Clearpass SAML Login Fails with Error "Failed to verify Idp signature"
Last Updated:
Overview
Admins or Users encounter the HTTP 403 status code and the following error when attempting SAML login to Aruba Clearpass:
Failed to verify Idp signature
The server understood the request but refuses to authorize it
Applies To
- Aruba Clearpass
- Okta Identity Engine (OIE)
- Okta Classic
- Custom SAML
- Security Assertion Markup Language (SAML)
Cause
According to the Service Provider's documentation, this issue can be caused by the IDP certificate not being sent in the Assertion section of the response.
A time skew on the Aruba Clearpass server caused this error.
Solution
According to the Service Provider's article, this error can be seen if the IDP certificate is not included in the Assertion section of the response.
The default custom SAML application configuration is to include the certificate in the Assertion section ("Assertion Signature Signed"). To do so, please follow the steps below:
- Go to Admin Dashboard > Applications.
- Select SAML Application.
- Click on the General tab.
- Click on SAML Settings > Edit > Next.
- Click on Show Advanced Settings.
- Select Assertion Signature > Signed.
After confirming that the certificate is included, if the issue persists, additional logging can be enabled on the SP Side.
Collect the CPPM logs with Clearpass network services service in debug and replicate the issue again.
Clearpass server logs can be collected following the next steps:
- Navigate to Administration.
- Select Server Manager.
- Select Server Configuration.
- Click on Collect Logs to collect the server logs.
In the policy manager logs, navigate to tips-network-services > network-services.log.0.
This issue has been seen to be caused by time skew on the Aruba Clearpass server. The SP logs will indicate:
the condition states that assertion is no longer valid (is the server time correct?)
Update NTP settings on the Clearpass server and then recreate the login attempt.
