SAML Vulnerability Fix for 6.8 version
As mentioned in the below post, we have attached the compatible jars and we can follow the below steps for the fix.
https://connect.zoho.com/portal/intranet/stream/105000699940145/105000702986572
Steps:
Remove xmlsec-1.4.1.jar from lib
Place xmlsec-2.2.3.jar (attached) in lib
Place the saml_xmlsec_changes_11200_13005.fjar in <sdp_home>/fixes folder
Create folder if does not exist
Restart SDP service.
Note: we have uploaded as zip, as the extension jar is not supported in supportdesk
The jar is compatible for
SDP: 11200-13005
AE: 6.8 versions
Similiar tickets
New to ADSelfService Plus?
Related Articles
SAML | Multiple Login URLs for SAML Response
Issue: Even if SDP can be accessed with multiple URLs like internal.servicedesk.com and external.servicedesk.com, the SAML response is always received at the same URL that is configured in Alias URL. Fix: The acs_url column in the SAMLSP table can be ...SAML - Login page would not reflect SAML option
Issue: In some cases, even after configuration and enabling of SAML option, it does not appear in the login page. However, if you notice in login page customization, the SAML option appears. Root cause: Check SAML - Service provider details. ...SAML | This Request will not be considered since passing more parameters to server might result in vulnerability issues.
Issue: After upgrade, customer might usually face this issue during SAML login: Trace: [14:14:03:012]|[10-02-2023]|[com.manageengine.mdh.MDHSettings]|[INFO]|[57303]: Service desk instance ID not found in Cookie| ...Unable to configure SAML using OneLogin -Uploaded Certificate is Invalid
Upon configuring SAML, if you come across the below errors: Uploaded Certificate is Invalid (Happens with .PEM cert generated in OneLogin) failed to update IdP details. Check logs for details Verify the below trace in the Logs: ...HTTP ERROR 400 when logging in via SAML - Description and Resolution
Description: When logging into the application via SAML, the following error occurs even when the configurations are accurate. Overview: When you see an HTTP ERROR 400 during a SAML login, it means there’s a "Bad Request" error. This error occurs ...