Login to the CPM using an IDP may fail with the "Invalid issuer" error message
If you're using an IDP, login to the CPM may fail with the following error message:
login failed. reason: Invalid issuer in the Assertion/Response (invalid_response):
It also may be found in the cpm_server.log:
ERROR: complete_directory_service_signin(additional_views.py:1605) login failed. reason: Invalid issuer in the Assertion/Response (invalid_response)
It may happen because a wrong Entity ID was entered, or an extra character was added at the end. For example, if a "/" character was added at the end, or "https" prefix was used instead of "http".
You can check it by logging to the CPM using local root user, and by checking "Identity Provider" section in the "General Settings".
Specify this setting with no special characters at the end, click "Apply" and try to login using Identity Provider again, or use the "Test connection..." option.
Related Articles
How To Integrate Okta SSO IdP with CPM 3.0 and above
Background: This document details the steps needed to configure Okta Single Sign On IdP and N2WS Cloud Protection Manager 3.0+. This KB will walk through configuring a new application in Okta to use with CPM as well as configuring CPM with Okta's ...How to Integrate Okta Single Sign on with Cloud Protection Manager with N2WS 2.x
Background: This document details the required configuration steps to take in Okta Single Sign On and Cloud Protection Manager(CPM). It walks you through creating a new Application to use with Okta. Please note that integration with CPM and Okta is ...How to Integrate CPM with ADFS to allow Idp logins from windows AD users
Background: This How-To guide will outline how to configure CPM and a windows ADFS server to allow IdP logins. Before you get started you will need to check the prerequisites. This is very important. If they are not met or the Domain and any of the ...Failed to login to AD FS with the error: "The status code of the Response was not Success, was Requester -> urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy (invalid_response)"
Issue: When trying to login to AD FS from CPM, you may receive an error: "The status code of the Response was not Success, was Requester -> urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy (invalid_response)" The same error can be found in the ...CPM server may display error "Signature validation failed. SAML Response rejected"
During login via Identity Provider on the sign on page or during the Test Connection, CPM server may display error message: login failed. reason: Signature validation failed. SAML Response rejected (invalid_response) You may find corresponding errors ...