Troubleshooting SAML authentication

If the SAML configuration is working correctly, when the browser connects to the SafeLinx service URL (the issuer value in config.yml), users are challenged for their IdP credentials. You can view the flow in the SafeLinx wg.log file. Here are problems you might encounter with SAML authentication and suggested solutions.

  • The SafeLinx SAML service is not running.
    To check that the SafeLinx SAML service is running:
    • On Windows, view the safelinx-saml service in system services.
    • On Linux, query the status of the service with the command systemctl status safelinx-saml.
    If the SAML service is not running, messages such as the following are seen:
    safelinx-saml.service - HCL SafeLinx SAML SP
       Loaded: loaded (/etc/systemd/system/safelinx-saml.service; enabled; vendor preset: disabled)
       Active: inactive (dead) since Mon 2022-01-31 20:16:32 UTC; 2s ago
      Process: 989 ExecStart=/opt/hcl/SafeLinx/saml/sl-saml-linux (code=killed, signal=TERM)
     Main PID: 989 (code=killed, signal=TERM)
    If the SAML service is not running, try stopping and then restarting the SafeLinx server. For information, see Stopping the SafeLinx Server and Starting the SafeLinx Server. Or on Linux, you can use the command sudo systemctl start safelinx-saml.
  • Error: 503 Service Unavailable

    This error can occur when a web browser tries to connect to https://<fqdn_of_http_access_service>/SL_saml/login/callback and the Disable password verification was not selected in the LDAP-bind Authentication profile when you completed the procedure Configuring SAML authentication. Select that option in the profile and try to connect again.

  • Error: SAML provider returned Requester error: InvalidNameIDPolicy at C:\snapshot\sl-saml\node_modules\passport-saml\lib\passport-saml\saml.js:699:51

    If ADFS is the IdP, this error usually means that identifierFormat was not set to null in the config.yml when you completed the procedure Configuring SAML authentication. Set that property and try to connect again.