Troubleshooting SAML Single Sign-On in Jamf Pro

Jamf Pro Documentation 11.30.0
Solution
Application
Content Type
Technical Documentation
Utilities & Services
version
11.30.0
ft:locale
en-US
vrm_version
11.30.0

To view or download the Jamf Pro server log, see Viewing or Downloading the Jamf Pro Server Log in the Jamf Pro Documentation.

Error MessageLog MessageCauseResolution

"An error occurred while processing your Single Sign-On request. Contact your administrator for assistance."

Jamf Pro Log: authentication.AuthenticationServiceException (Spring Security)

"Error validating SAML message"

Signing certificate is invalid.

Ensure that certificates from your Identity Provider and Jamf Pro are valid.

Remember to refresh Jamf Pro Metadata after making changes.

"An error occurred while processing your Single Sign-On request. Contact your administrator for assistance."

Jamf Pro Log: authentication.CredentialsExpiredException (Spring Security)

"Authentication statement is too old to be used"

Identity provider and the Jamf Pro Single Sign-On session lifetime are not set to the same value.

Adjust the token expiration settings.

"An error occurred while processing your Single Sign-On request. Contact your administrator for assistance."

Jamf Pro Log: common.SAMLException (OpenSaml)

"Metadata includes wantAssertionSigned, but neither Response nor included Assertion is signed"

Identity provider does not sign SAML assertions.

Verify your IdP configuration.

"Access Denied. Contact your administrator to request access to the Jamf Pro server."

User was not mapped to Jamf Pro.

Check the following:

  • Whether the corresponding user or group exists in Jamf Pro

  • Your Identity Provider sent the correct values

  • User or Group Mapping are correctly configured

"Metadata file does not contain signing certificate information"

When uploading a metadata file to the Jamf Pro server, error is displayed when the KeyDescriptor element in the metadata file does not contain the use=signing attribute.

Add the attribute to the file:

  1. Open the metadata file downloaded from Jamf Pro.
  2. Locate the KeyDescriptor element under IDPSSODescriptor.
  3. Add the use=signing attribute to the KeyDescriptor element.
  4. Save the metadata file and upload it again to the Jamf Pro server.

For all other issues, contact Jamf Support.