SAML | InResponseTo attribute in SAML Response is missing - error code 50

SAML | InResponseTo attribute in SAML Response is missing - error code 50

What is InResponseTo?

SDP will send a unique identifier named 'ID' in every SAML request and the IDP must return this ID in every SAML response named 'InResponseTo'. Most of the popular IDPs return this and this and SDP will check this for security reasons.

Response without InResponseTo:


Expected Response:


Case 1: Bookmarked/Cached SAMLRequests:

If you have a button in a web portal or a bookmark to start a SAML login, do not copy an existing SAML request URL and use it here. You must ensure that the target URL is <sdp>/SamlRequestServlet only.

Case 2: SameSiteCookie as 'Lax' or 'Strict':

Some customers run security reports and these reports ask to change the samesitecookie setting as 'Lax' or 'Strict'. Please note that samesite must be set to 'none' in order for SAML to work. Connect to application database, run the following query and restart the services to set the samesite as 'none'.
Quote
update globalconfig set paramvalue='none' where "parameter"='SAMESITECOOKIE';

Case 3: Some custom IDPs do not send this.

If your custom IDPs do not return this by default, this needs to be included now. Please request your IDP admin to add InResponseTo attribute to the SAML response by altering the IDP settings.

Case 4: Some complex environment condition causes failure.

If you have a complex environment where this cannot be propagated to SDP and this validation needs to be removed, please contact our support team with your version number (especially if your version is above 15140 or not), but this is not recommended and can lead to security vulnerabilities.