[BUG] ERROR: SAML provider returned Responder error: undefined

[LeonardoDB]

Hi everyone

I'm getting this error 'Error: SAML provider returned Error response: undefined' when some users try to send callback to authenticate saml

Error: SAML provider returned Responder error: undefined
    at SAML.validatePostResponseAsync (/opt/node_modules/passport-saml/lib/node-saml/saml.js:637:39)
    at runMicrotasks (<anonymous>)
    at processTicksAndRejections (internal/process/task_queues.js:97:5)

Can anyone help me urgently?

Environment

• Operating System:
• Node version: 12
• passport-saml: ^3.1.0

[srd90]

First of all ^3.1.0 is not exact version.

@LeonardoDB you wrote:

I'm getting this error 'Error: SAML provider returned Error response: undefined'...

Error message you pasted is

SAML provider returned Responder error: undefined

Lets assume you had passport-saml 3.1.0 in which case this error would have come from this codeblock:

passport-saml/src/node-saml/saml.ts

Lines 856 to 871 in f1e00b6

	if (statusCode && statusCode[0].$.Value) {
	const msgType = statusCode[0].$.Value.match(/[^:]*$/)[0];
	if (msgType != "Success") {
	let msg = "unspecified";
	if (status[0].StatusMessage) {
	msg = status[0].StatusMessage[0]._;
	} else if (statusCode[0].StatusCode) {
	msg = statusCode[0].StatusCode[0].$.Value.match(/[^:]*$/)[0];
	}
	const statusXml = buildXml2JsObject("Status", status[0]);
	throw new ErrorWithXmlStatus(
	"SAML provider returned " + msgType + " error: " + msg,
	statusXml
	);
	}
	}

Your stacktrace's error message (msgType === Responder) indicates that your IdP rejected authn request due some reason and responded with urn:oasis:names:tc:SAML:2.0:status:Responder which indicates that source of problem is at IdP side / you should consult your IdP provider for further information.

The fact that msg === undefined could be caused either by bug in passport-saml implementation (i.e. it cannot dig proper value to it) or your IdP didn't provide additional information. Impossible to determine without seeing actual error response. Eitherway ask from your IdP provider whats happening and/or see from logs (if you have any) actual content of error response. If you determine that passport-saml should have been able to dig extra info (value to msg) provide some example of your error response you received so that you or someone else would be able to fix possible msg value extracting at passport-saml.

[cjbarth]

Until we have enough information to determine that this is actually an issue with passport-saml, we'll have this be a discussion.