I am attempting to enable SSO on our Sitecore 9.1 (initial release) installation. Our identity provider is Shibboleth which we currently use for several other systems.

My strategy was to disable Identity Server and configure federated authentication directly from Sitecore to Shibboleth (no Identity Server between).

Following this 3-part blog post I was able to get it working… mostly. Part 3: https://blogs.perficientdigital.com/2018/06/06/federated-authentication-in-sitecore-9-part-3-implementation-of-saml2p/

The issue is that it works in the browser (hence forth called browser "S" for success) I was using while working on the solution but NOT when running in incognito mode (browser "F" for fails).

The issue seems to be cookies… or rather a lack of cookies.

The error I see in the Owin.log.* file as a result of a failed login attempt with browser "F" is:

11380 13:32:22 ERROR Sustainsys.Saml2.Owin.Saml2AuthenticationMiddleware - Saml2 Authentication failed. The received SAML data is 
………lot’s of data here……..

Exception: Sustainsys.Saml2.Exceptions.UnexpectedInResponseToException
Message: Received message contains unexpected InResponseTo "ide14965ae7bfb4ba3a7f10330bae6e9e3". No cookie preserving state from the request was found so the message was not expected to have an InResponseTo attribute. This error typically occurs if the cookie set when doing SP-initiated sign on have been lost.
Source: Sustainsys.Saml2
   at Sustainsys.Saml2.Saml2P.Saml2Response.ReadAndValidateInResponseTo(XmlElement xml, Saml2Id expectedInResponseTo, IOptions options)
   at Sustainsys.Saml2.Saml2P.Saml2Response..ctor(XmlElement xml, Saml2Id expectedInResponseTo, IOptions options)
   at Sustainsys.Saml2.WebSso.AcsCommand.Run(HttpRequestData request, IOptions options)
   at Sustainsys.Saml2.Owin.Saml2AuthenticationHandler.<AuthenticateCoreAsync>d__0.MoveNext()

Based on this error message, I started looking at the browser cookies. When I compare traffic using Fiddler between browsers "S" and "F", I found a difference when navigating from the login screen to the Identity Provider (aka - clicking the "Saml Connect" button.. see screenshot).

enter image description here

On browser "S" several cookies are sent in the request and a cookie is set in the response. On browser "F" no cookies are sent in the request (not even ASP.NET Session cookie) and no cookies are set in the response.

Now, if I use browser "F" and login with native Sitecore creds first, THEN login with "Saml Connect", it works. The difference seems to be that there are now cookies in the browser to send (see screenshot)

enter image description here

So the question is why is there no cookie being set in browser "F"? Have you seen this issue before and know any workarounds?

EDIT: After some more troubleshooting, it is specifically the presence of the ASP Session cookie that determines if login works or not.


Detailed troubleshooting/solution: https://sitecorepm.wordpress.com/2019/11/01/sitecore-9-1-to-shibboleth-via-saml2/

TLDR; answer

This was due to a Katana (OWIN/Asp.Net) known issue that causes cookies to get dropped between OWIN and ASP.NET.

Add the Kentor.OwinCookieSaver nuget package to your project and hook it in to your OWIN pipeline BEFORE any cookie handling middleware.

  • Good that you found that it was due to the owin cookie problem, but the Kentor.OwinCookieSaver package is not updated and there is now a better solution from Microsoft using the SystemWebCookieManager. Ps. I'm the author of both the Sustainsys.Saml2 package and the Kentor.OwinCookieSaver. – Anders Abel Apr 23 '20 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.