Unable to Save Metadata

Symptom

When you attempt to save SAML metadata for a federation partner, the operation fails and the metadata is not persisted.

Cause

The metadata XML may contain invalid characters, malformed elements, or namespaces that RapidIdentity does not accept. The metadata may also exceed the maximum field size, or the signing certificate within the metadata may be expired or unreadable.

Resolution

1. Validate the metadata XML against the SAML 2.0 metadata schema.
2. Confirm that the certificate within the metadata is current and PEM-encoded.
3. Remove any non-standard or vendor-specific extensions from the metadata.
4. Save the metadata again.

Error Decoding Request Messages

Symptom

When a service provider sends a SAML AuthnRequest to RapidIdentity, authentication fails and the RapidIdentity logs report an error decoding the request message.

Cause

The AuthnRequest may be malformed, signed with an untrusted certificate, or sent using a binding that does not match the binding configured on the Federation Partner. The request may also be missing required elements such as the issuer or the AssertionConsumerService URL.

Resolution

1. Verify that the service provider's signing certificate matches the certificate in the metadata configured on the RapidIdentity Federation Partner.
2. Confirm that the AuthnRequest binding (HTTP Redirect or HTTP POST) matches the binding configured on the Federation Partner.
3. Review the request payload to confirm the issuer and AssertionConsumerService URL match the values registered on the federation partner.
4. Reload the identity provider services so that any updated federation partner configuration is applied.