Problem

Login via SSO with Okta fails, and you get an error in the tracker, with a message "Something bad happened: null".

Diagnosis

In the log file, there are similar errors to the below:

2024-10-23 13:36:07,302+0000 http-nio-8080-exec-19 url: /plugins/servlet/samlsso ERROR anonymous 816x1141x1 16e6we 77.11.179.58,10.2.88.105 /plugins/servlet/samlsso [o.a.x.security.encryption.XMLCipher] XMLCipher::decryptElement unable to resolve a decryption key
2024-10-23 13:36:07,303+0000 http-nio-8080-exec-19 url: /plugins/servlet/samlsso WARN anonymous 816x1141x1 16e6we 77.11.179.58,10.2.88.105 /plugins/servlet/samlsso [c.o.saml2.util.Util] Error executing decryption: encryption.nokey
org.apache.xml.security.encryption.XMLEncryptionException: encryption.nokey
	at org.apache.xml.security.encryption.XMLCipher.decryptToByteArray(XMLCipher.java:1757)
	at org.apache.xml.security.encryption.XMLCipher.decryptElement(XMLCipher.java:1673)
	.
	.
2024-10-23 13:36:07,305+0000 http-nio-8080-exec-19 url: /plugins/servlet/samlsso WARN anonymous 816x1141x1 16e6we 77.11.179.58,10.2.88.105 /plugins/servlet/samlsso [c.r.a.s.tracker.activeobjects.AuthenticationTrackerActiveObjectsProxy] Adding ExceptionInfo for this Exception to HN6Q1EHYJ32VJGB:
com.resolution.samlwrapper.api.exception.MessageReadingException: Something bad happened: null
	at com.resolution.samlwrapper.osj.SAMLResponseReader.readAndValidateSamlResponse(SAMLResponseReader.java:120)
	at com.resolution.samlwrapper.osj.SAMLResponseReader.validateSAMLResponseAndReadLoginInformation(SAMLResponseReader.java:52)
	at com.resolution.samlwrapper.osj.SAMLWrapperImpl.handleSAMLResponse(SAMLWrapperImpl.java:622)
	at com.resolution.samlwrapper.osj.SAMLWrapperImpl.handleSAMLMessage(SAMLWrapperImpl.java:592)
	at com.resolution.atlasplugins.samlsso.servlet.SamlSsoServlet.processRequest(SamlSsoServlet.java:170)
	at com.resolution.atlasplugins.samlsso.servlet.BasicServlet.doPost(BasicServlet.java:100)
	.
	.
Caused by: java.lang.NullPointerException
	at com.onelogin.saml2.authn.SamlResponse.decryptAssertion(SamlResponse.java:1319)
	at com.onelogin.saml2.authn.SamlResponse.loadXml(SamlResponse.java:221)
	at com.onelogin.saml2.authn.SamlResponse.loadXmlFromBase64(SamlResponse.java:187)
	at com.onelogin.saml2.authn.SamlResponse.<init>(SamlResponse.java:122)
	at com.resolution.samlwrapper.osj.SAMLResponseReader.readAndValidateSamlResponse(SAMLResponseReader.java:93)
	... 335 more
CODE

Solution

The above indicates that the Assertion Encryption in Okta has been enabled but doesn't have the correct certificate from the SAML SSO plugin (the service provider).

To fix that:

  1. In the SAML Single Sign On Configuration page, in the Service Provider tab, copy the Service Provider Certificate
  2. In Okta and under SAML Settings, click Edit
  3. Navigate to step 2 (Configure SAML) and click on “Show Advanced Settings”
  4. Upload the new certificate to be used both as Encryption and Signature certificate
  5. Save the settings