CWSML

CWSML0000E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML0001E: No key information is available for the SAML Provider (Token issuer).

Explanation

The key information for the Security Assertion Markup Language (SAML) provider in not available to sign a SAML assertion.

Action

Check the configuration information for the provider and ensure that the signing key information for the provider exists in its respective keystore.

CWSML0002E: No key alias was provided.

Explanation

A key information object is not associated with a key alias.

Action

Ensure that the key information object is associated with an alias during the creation process.

CWSML0003E: No Subject was specified. Can not create a valid CredentialConfig object.

Explanation

An attempt to create a CredentialConfig object, which is based on a null Subject, has been detected. A valid CredentialConfig object cannot be created.

Action

Specify a valid Subject.

CWSML0004E: Subject does not have a Principal. Can not create a valid CredentialConfig object.

Explanation

An attempt to create a CredentialConfig object, which is based on a Subject without a Principal, has been detected. A valid CredentialConfig object cannot be created.

Action

Specify a valid Subject with a valid Principal.

CWSML2000E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2001E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2002E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2003E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2004E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2005E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2006E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2007E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2008E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2009E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2010E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2011E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2012E: SAML Issuer address does not exist.

Explanation

The SAML Assertion Issuer address provided is not valid.

Action

Ensure that the Security Assertion Markup Language (SAML) Assertion Issuer address is valid.

CWSML2013E: Signed SAML could not be modified.

Explanation

A signed SAML cannot be modified.

Action

A signed SAML cannot be modified.

CWSML2014E: Only String or OMElement allowed for marshalling.

Explanation

Only a string or OMElement data type is allowed for marshalling.

Action

Provide either the required String or OMElement data type.

CWSML2015E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2016E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2017E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2018E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2019E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2020E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2021E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2022E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2023E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2024E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2025E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2026E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2027E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2028E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2029E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2030E: The specified confirmation method is not supported.

Explanation

An unsupported confirmation method has been specified.

Action

Specify a "bearer," "holder-of-key," or "sender-vouches" confirmation method.

CWSML2031E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2032E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2033E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2034E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2035E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2036E: This method is not implemented.

Explanation

This method is not implemented.

Action

None

CWSML2037E: Create request for TokenType is not valid.

Explanation

The create request for the TokenType value is not valid.

Action

Provide a valid TokenType value.

CWSML2038E: Unknown SAML assertion namespace.

Explanation

The Security Assertion Markup Language (SAML) assertion namespace is not known.

Action

Provide a valid namespace.

CWSML2039E: Invalid SAML assertion.

Explanation

The Security Assertion Markup Language (SAML) assertion during the call to the newSAMLToken method is not valid.

Action

Ensure that you provide a valid SAML assertion.

CWSML2040E: Could not create SAML token from XMLStructure.

Explanation

The Security Assertion Markup Language (SAML) token cannot be created from the XMLStructure value during a call to the newSAMLToken method.

Action

Ensure that you provide a valid XML structure for the assertion.

CWSML6001E: Null or empty NameID provided for the issuer.

Explanation

The Security Assertion Markup Language (SAML) issuer is not associated with a name identifier.

Action

Ensure that the SAML provider is associated with a name identifier.

CWSML6002E: Unsupported Statement type.

Explanation

This Security Assertion Markup Language (SAML) statement is not supported.

Action

Do not use unsupported SAML statements.

CWSML6003E: Null or empty ID.

Explanation

A Null or empty ID has been provided for a Security Assertion Markup Language (SAML) assertion.

Action

Provide a name identifier.

CWSML6004E: Null issue Date provided.

Explanation

A null issue date has been provided.

Action

Do not provide a null date value.

CWSML6005E: Signed SAML assertion is not allowed to be modified.

Explanation

You cannot modify a signed Security Assertion Markup Language (SAML) assertion.

Action

Do not attempt to modify a signed SAML assertion.

CWSML6006E: Only String or OMElement are allowed for marshalling.

Explanation

You cannot marshal an object that is not a String or an OMElement data type.

Action

Check the type of object that you are attempting to marshal and ensure that it is a String or a OMElement data type.

CWSML6007E: Invalid AuthnContextClassRef.

Explanation

The authentication method is not valid.

Action

Use a valid authentication method.

CWSML6008E: A null value was passed.

Explanation

A null argument value has been passed on a setAuthnContext method call.

Action

Do not pass a null argument value.

CWSML6009E: A null value was passed.

Explanation

A null argument value has been passed on a setAuthnInstant method call.

Action

Do not pass a null argument value.

CWSML6010E: Invalid SAML assertion.

Explanation

The Security Assertion Markup Language (SAML) assertion on a newSAMLToken method call is not valid.

Action

Pass a valid XML structure for the assertion.

CWSML6011E: Could not create SAML token from XMLStructure.

Explanation

A Security Assertion Markup Language (SAML) token cannot be created from the XMLStructure that is provided on a call to the newSAMLToken method.

Action

Pass a valid XML structure for the assertion.

CWSML6012E: The expected Token type is SAML 2.0.

Explanation

The expected token type is SAML 2.0. However, a different version has been found.

Action

Pass a valid SAML 2.0 version string.

CWSML6013E: An element or attribute: {0} was missing

Explanation

The missing element and attribute must be specified.

Action

Check and modify token issuer configuration.

CWSML6014E: Parameter type is not {0}

Explanation

The parameter type is incorrect.

Action

Check and modify to use the correct class type.

CWSML7000E: The NotBefore condition is out of range. The NotBefore setting in the assertion is [{0}]. The current time is [{1}]. The current clock skew setting is {2} minutes.

Explanation

The Security Assertion Markup Language (SAML) assertion was received at a time that is earlier than the NotBefore setting in the assertion. This condition is not allowed. A possible reason for the error is that the receiver's clock is out of sync with the clock of the creator of the assertion.

Action

Synchronize the clocks of the receiver and the creator of the assertion or increase the clock skew using the clockSkew custom property on the configured SAML token consumer.

CWSML7001E: The NotOnOrAfter condition is out of range. The NotOnOrAfter setting in the assertion is [{0}]. The current time is [{1}]. The current clock skew setting is {2} minutes.

Explanation

The Security Assertion Markup Language (SAML) assertion was received at a time that is at or after the NotOnOrAfter setting in the assertion. This condition is not allowed. Possible reasons for the error are that the receiver's clock is out of sync with the clock of the creator of the assertion or the assertion has been obtained and resent by an unauthorized application.

Action

Synchronize the clocks of the receiver and the creator of the assertion or increase the clock skew using the clockSkew custom property on the configured SAML token consumer.

CWSML7002E: The IssueInstant in the assertion is after the current time. The IssueInstant setting in the assertion is [{0}]. The current time is [{1}]. The current clock skew setting is {2} minutes.

Explanation

The IssueInstant in the Security Assertion Markup Language (SAML) assertion indicates that it was issued after the current time. This condition is not allowed. A possible reason for the error is that the receiver's clock is out of sync with the clock of the creator of the assertion.

Action

Synchronize the clocks of the receiver and the creator of the assertion or increase the clock skew using the clockSkew custom property on the configured SAML token consumer.

CWSML7003E: The [{0}] attribute on the Assertion element is missing or empty.

Explanation

A Security Assertion Markup Language (SAML) assertion must contain the attribute shown in the message. The SAML assertion being validated does not have this attribute, or the attribute does not have a value.

Action

Ensure that the creator of the SAML assertion includes the attribute in the error message on the Assertion element.

CWSML7004E: The [{0}] element in the Assertion element is missing or empty.

Explanation

A Security Assertion Markup Language (SAML) assertion must contain the element shown in the message. The SAML assertion being validated either does not have this element, or the element does not have a value.

Action

Ensure that the creator of the SAML assertion includes the element indicated in the error message in the Assertion.

CWSML7005E: The SAML assertion contains an [{0}] element, but that element is empty. The [{0}] element cannot be empty.

Explanation

The Security Assertion Markup Language (SAML) assertion contains the element shown in the message, but there is no value for the element. This condition is not allowed.

Action

Ensure that the creator of the SAML assertion includes a value for the element shown in the message.

CWSML7006E: The [{0}] attribute on the [{1}] element is missing or empty. This condition is not allowed.

Explanation

When a Security Assertion Markup Language (SAML) assertion contains the element shown in the message, it must also contain the attribute shown in the message. The SAML assertion being validated does not have the attribute shown in the message, or the attribute does not have a value.

Action

Ensure that the creator of the SAML assertion includes the attribute shown in the message.

CWSML7007E: The SAML assertion being processed is not valid.

Explanation

The Security Assertion Markup Language (SAML) assertion on a newSAMLToken method call or inbound message is not valid. The reason for the error will be shown after this message.

Action

See the user action for the message that appears after this error.

CWSML7008E: The value [{0}] for the [{1}] attribute on the [{2}] element in the SAML assertion is not valid. The valid values are [{3}].

Explanation

An element in the Security Assertion Markup Language (SAML) assertion being processed contains an attribute that is not supported. The valid values are shown in the message.

Action

Ensure that the creator of the SAML assertion includes a valid value for the element's attribute shown in the message.

CWSML7009E: The value [{0}] for the [{1}] sub-element of [{2}] in the SAML assertion is not valid. The valid values are [{3}].

Explanation

An element in the Security Assertion Markup Language (SAML) assertion being processed contains an element value that is not supported. The valid values are shown in the message.

Action

Ensure that the creator of the SAML assertion includes a valid value for the element shown in the message.

CWSML7010E: The [{0}] sub-element of the [{1}] element in the SAML assertion element is missing or empty.

Explanation

A Security Assertion Markup Language (SAML) assertion must contain the element pair shown in the message. The SAML assertion being validated either does not have the sub-element shown in the message, or the sub-element does not have a value.

Action

Ensure that the creator of the SAML assertion includes the element pair indicated in the error message in the Assertion.

CWSML7011E: An element exists in the SAML assertion that is not supported. The unsupported element is [{0}].

Explanation

The Security Assertion Markup Language (SAML) assertion being processed contains an element that is valid for the schema, but the run time does not support the element. Processing of the SAML assertion has stopped.

Action

Ensure that the creator of the SAML assertion does not include the element shown in the error message.

CWSML7012E: An element exists in the SAML assertion that is not supported. The unsupported element is [{0}] and it is a sub-element of [{1}].

Explanation

Action

Ensure that the creator of the SAML assertion does not include the element shown in the error message.

CWSML7013E: The [AttributeStatement] element does not contain either [Subject] or [Attribute] sub-elements. This condition is not allowed.

Explanation

If a Security Assertion Markup Language (SAML) V1.1 assertion contains an AttributeStatement element, the AttributeStatement element must contain at least one Subject or Attribute sub-elements. The SAML 1.1 assertion being validated contains an AttributeStatement element that contains neither Subject or Attribute sub-elements.

Action

Ensure that the creator of the SAML assertion either does not include the AttributeStatement element, or includes at least one of the Subject or Attribute sub-elements in the AttributeStatement element.

CWSML7014E: The AuthenticationInstant in the assertion is after the current time. The AuthenticationInstant setting in the assertion is [{0}]. The current time is [{1}]. The current clock skew setting is {2} minutes.

Explanation

The AuthenticationInstant in the Security Assertion Markup Language (SAML) assertion indicates that it was issued after the current time. This condition is not allowed. A possible reason for the error is that the receiver's clock is out of sync with the clock of the creator of the assertion.

Action

Synchronize the clocks of the receiver and the creator of the assertion or increase the clock skew using the clockSkew custom property on the configured SAML token consumer.

CWSML7015E: The [Subject] element does not contain either [NameIdentifier] or [SubjectConfirmation] sub-elements. This condition is not allowed.

Explanation

If a Security Assertion Markup Language (SAML) V1.1 assertion contains a Subject element, the Subject element must contain at least one NameIdentifier or SubjectConfirmation sub-elements. The SAML 1.1 assertion being validated contains a Subject element that contains neither NameIdentifier or SubjectConfirmation sub-elements.

Action

Ensure that the creator of the SAML assertion either does not include the Subject element, or includes at least one of the NameIdentifier or SubjectConfirmation sub-elements in the Subject element.

CWSML7016E: The SAML 1.1 assertion being processed contains no [ConfirmationMethod] elements. At least one [ConfirmationMethod] element must be present in the SAML assertion to be processed successfully.

Explanation

In the Security Assertion Markup Language (SAML) V1.1 schema, the ConfirmationMethod element is a child of the SubjectConfirmation element. Although the schema does not require that the ConfirmationMethod be present in the SubjectConfirmation element, in order for a SAML assertion to be processed successfully, at least one ConfirmationMethod must be present in the assertion. The valid values for the ConfirmationMethod element are [urn:oasis:names:tc:SAML:1.0:cm:bearer, urn:oasis:names:tc:SAML:1.0:cm:sender-vouches, and urn:oasis:names:tc:SAML:1.0:cm:holder-of-key].

Action

Ensure that the creator of the SAML assertion includes at least one ConfirmationMethod in the assertion. The ConfirmationMethod element is a child of the SubjectConfirmation element. The SubjectConfirmation element is a child of the Subject element, which can be a child of either the AttributeStatement or AuthenticationStatement elements.

CWSML7017E: The AuthnInstant in the assertion is after the current time. The AuthnInstant setting in the assertion is [{0}]. The current time is [{1}]. The current clock skew setting is {2} minutes.

Explanation

The AuthnInstant in the Security Assertion Markup Language (SAML) assertion indicates that it was issued after the current time. This condition is not allowed. A possible reason for the error is that the receiver's clock is out of sync with the clock of the creator of the assertion.

Action

Synchronize the clocks of the receiver and the creator of the assertion or increase the clock skew using the clockSkew custom property on the configured SAML token consumer.

CWSML7018E: The SessionNotOnOrAfter condition is out of range. The SessionNotOnOrAfter setting in the assertion is [{0}]. The current time is [{1}]. The current clock skew setting is {2} minutes.

Explanation

The Security Assertion Markup Language (SAML) assertion was received at a time that is at or after the SessionNotOnOrAfter setting in the assertion. This condition is not allowed. Possible reasons for the error are that the receiver's clock is out of sync with the clock of the creator of the assertion or the assertion has been obtained and resent by an unauthorized application.

Action

Synchronize the clocks of the receiver and the creator of the assertion or increase the clock skew using the clockSkew custom property on the configured SAML token consumer.

CWSML7019E: The value for the Version attribute is not supported. The Version attribute value in the assertion is [{0}]. The value for the Version attribute in a SAML 2.0 assertion must be [{1}].

Explanation

The value for the Version attribute in the Security Assertion Markup Language (SAML) V2.0 assertion being processed is not correct. There is only one correct value. The correct value is shown in the message.

Action

Ensure that the creator of the SAML assertion sets the Version attribute in the SAML 2.0 assertion correctly.

CWSML7020E: The [NotBefore] condition on the [SubjectConfirmationData] element is out of range. The NotBefore setting in the SubjectConfirmationData is [{0}]. The current time is [{1}]. The current clock skew setting is {2} minutes.

Explanation

The Security Assertion Markup Language (SAML) assertion was received at a time that is earlier than the NotBefore setting on the SubjectConfirmationData in the assertion. This condition is not allowed. A possible reason for the error is that the receiver's clock is out of sync with the clock of the creator of the assertion.

Action

Synchronize the clocks of the receiver and the creator of the assertion or increase the clock skew using the clockSkew custom property on the configured SAML token consumer.

CWSML7021E: The [NotOnOrAfter] condition on the [SubjectConfirmationData] element is out of range. The NotOnOrAfter setting in the SubjectConfirmationData is [{0}]. The current time is [{1}]. The current clock skew setting is {2} minutes.

Explanation

The Security Assertion Markup Language (SAML) assertion was received at a time that is at or after the NotOnOrAfter setting on the SubjectConfirmationData in the assertion. This condition is not allowed. Possible reasons for the error are that the receiver's clock is out of sync with the clock of the creator of the assertion, the assertion was cached on the client and resent after it expired, or the assertion has been obtained and resent by an unauthorized application.

Action

Synchronize the clocks of the receiver and the creator of the assertion, increase the clock skew using the clockSkew custom property on the SAML token consumer in the WS-Security provider bindings or, if using a WebSphere Application Server client, increase the cache cushion using cacheCushion custom property on the SAML token generator in the WS-Security client bindings.

CWSML7022E: The [{0}] object is read-only. The [{1}] method cannot be performed on a read-only object.

Explanation

The method shown in the message was performed on an object that is read-only. This method is not allowed on read-only objects.

Action

Ensure that the object is not read-only or do not invoke the method.

CWSML7023E: The Assertion XML associated with the [{0}] object is encrypted. The [{1}] method cannot be performed on an encrypted Assertion.

Explanation

The method shown in the message was performed on an object that contains an encrypted Assertion. This method is not allowed on an object that contains an encrypted Assertion.

Action

Ensure that the object does not contain an encrypted Assertion or do not invoke the method.

CWSML7024W: [{0}] is set on the SAMLAttribute [{1}]. {0} is not supported for a {2} token. The setting for {0} will be ignored and will not be reflected in the SAML XML.

Explanation

A SAMLAttribute object has a value set in a field that is not supported by the SAML token type that it is being added to. The attribute will be added to the SAML token, but the value for the unsupported attribute will not be reflected in the XML associated with the SAML token.

Action

Do not set values in a SAMLAttribute object that are incompatible with the SAML token type to which they are being added.

CWSML7025E: The [{0}] sub-element of the KeyInfo element in the Security Assertion Markup Language (SAML) assertion is not supported. The supported elements are [{1}].

Explanation

The element shown in the message is used to retrieve the certificate to validate the signature or the key to decrypt the SAML assertion. The run time only supports a subset of retrieval methods. The methods that are supported are shown in the message.

Action

Ensure that the creator of the SAML assertion uses one of the supported KeyInfo types.

CWSML7026E: The [{0}] sub-element of the X509Data element in the Security Assertion Markup Language (SAML) assertion is not supported. The supported elements are [{1}].

Explanation

The element shown in the message is used to retrieve the certificate to validate the signature or the key to decrypt the assertion. The run time only supports a subset of retrieval methods. The methods that are supported are shown in the message.

Action

Ensure that the creator of the SAML assertion uses one of the supported X509Data types.

CWSML7027E: The SecurityTokenReference element in the KeyInfo element in the Security Assertion Markup Language (SAML) assertion contains a sub-element that is not supported: [{0}]. The supported sub-elements are [{1}].

Explanation

Action

Ensure that the creator of the SAML assertion uses one of the supported SecurityTokenReference sub-elements.

CWSML7028E: The evaluated value for the KeyInfo element in the Security Assertion Markup Language (SAML) assertion does not match the key defined in the SAML the configuration: [{0}].

Explanation

A key was obtained from the SAML assertion. A key was defined in the SAML configuration. These two keys do not match. This condition is not allowed.

Action

Do one of the following: 1) Re-configure the SAML configuration to use the key that is in the SAML assertion. 2) Ensure that the creator of the SAML assertion uses the key defined in the SAML configuration.

CWSML7029E: An X.509 certificate was not obtained from the KeyInfo element in the Security Assertion Markup Language (SAML) assertion, so trust cannot be evaluated. Either use a KeyInfo method that yields a usable X.509 certificate or turn off trust validation. The supported methods are [{0}].

Explanation

The KeyInfo element in the SAML assertion is used to retrieve the certificate to validate the signature or the key to decrypt the assertion. Although the method in the assertion used to retrieve the certificate is sufficent to evaluate the signature, it is not sufficient to evaluate trust because it does not yield an X.509 certificate.

Action

Ensure that the creator of the SAML assertion uses one of the supported KeyInfo types that will yield an X.509 certificate or turn off trust validation.

CWSML7030E: The redirect target URL, [{0}], matches the value for the assertion consumer service (ACS) URL configured for this service provider. You cannot redirect to the ACS URL. The ACS URL is configured on the [{1}] TAI custom property.

Explanation

The redirect target URL matches the value configured for the ACS URL. This condition is not allowed.

Action

See the message that displays after CWSML7030E to determine where the redirect target URL was obtained then modify the SAML TAI configuration or IdP configuration to ensure that the redirect target URL does not match the ACS URL.

CWSML7031I: The redirect target URL was retrieved from the [{0}] parameter in the response.

Explanation

The redirect target URL was obtained from the SAMLResponse.

Action

No user action is required.

CWSML7032I: The redirect target URL was retrieved from the [{0}] or [{1}] TAI custom property. The [{2}] custom property is set to [{3}].

Explanation

The redirect target URL was obtained from the SAML TAI configuration.

Action

No user action is required.

CWSML7033E: The Security Assertion Markup Language (SAML) Web single sign-on TAI is unable to perform a redirect to the requested target URL [{0}].

Explanation

The SAML TAI can not redirect the client request to the requested URL.

Action

See the message that displays after CWSML7033E for the cause of the error.

CWSML7034I: The redirect target URL was retrieved from the WasSamlSpReqUrl cookie on the request.

Explanation

The redirect target URL was obtained from the SAMLResponse.

Action

No user action is required.

CWSML7035E: The SAML Web Single Sign-on (SSO) Trust Association Interceptor (TAI) is unable to determine a redirect target URL. The redirect URL can come from the sso_<id>.sp.targetUrl SAML TAI custom property, the RelayState parameter in the SAMLResponse or the WasSamlSpReqUrl cookie. If you do not intend to have a value for the sso_<id>.sp.targetUrl SAML TAI custom property or have your IdP send a RelayState parameter in the SAMLResponse, then check earlier in the log to see if you have a CWSML7036W warning that indicates that the request URL host name is not the same as the ACS URL host name. If you see that warning, then that condition must be corrected to fix this error. The value for the relayState parameter on the SAMLResponse is [{0}].

Explanation

The SAML Web SSO TAI cannot find a redirect URL for the current request. The redirect URL can come from three places: 1) the sso_<id>.sp.targetUrl SAML TAI custom property, 2) the RelayState parameter in the SAMLResponse and 3) the WasSamlSpReqUrl cookie. At least one of these three things must be present in order for the SAML TAI to be able to determine the redirect URL. In this case, none of these three things are present, therefore, the SAML TAI can not determine the redirect URL. Note that the SAML TAI may have set a WasSamlSpReqUrl cookie earlier in the process, but the browser did not make the cookie available to the SAML TAI. Also, the RelayState parameter must be a URL that uses the http or https protocol.

Action

Ensure at least one of the following is true: 1) the sso_<id>.sp.targetUrl SAML TAI custom property is configured for the current SP, 2) the IdP sets the RelayState parameter on the SAMLResponse with a valid URL that uses the http or https protocol or 3) the WasSamlSpReqUrl cookie is made available to the SAML TAI. In order for the WasSamlSpReqUrl to be available to the SAML TAI, the original request URL must have the same host name as the ACS URL that is configured on the sso_<id>.sp.acsUrl TAI custom property.

CWSML7036W: The SAML Web Single Single Sign-on request URL, [{0}], is directed to a host name that is not the same as the host name for the ACS URL, [{1}], that is configured on the [sso_<id>.sp.acsUrl] TAI custom property. When WebSphere redirects the request to the Identity Provider (IdP), the browser will associate the WasSamlSpReqUrl cookie that WebSphere creates with the host name associated with the request URL, [{2}]. The IdP must redirect the request back to the ACS URL. Since the request URL host name, [{2}], is not the same as the ACS URL host name, [{3}], the browser will not send the cookie with the redirected request. If the cookie is not present on the redirected request, the request cannot be redirected to the original URL after authentication. This warning will only be logged once per inbound host name. If you want to disable this warning message, set the [com.ibm.ws.security.web.saml.acs.hostWarnings] system property to [false] and restart the application server.

Explanation

The request URL has a host name that is not the same as the host name associated with the ACS URL. Two possible causes of this issue are: 1) the request is directed to a short host name, but the ACS URL is configured as a fully-qualified host name or vice-versa and 2) an IBM HTTP server (IHS) front end that services the request redirects to the protected resource on WebSphere and the IHS and WebSphere servers have different host names. If you get a CWSML7035E error later in your SAML TAI processing, then this problem must be corrected.

Action

If you get a CWSML7035E error later in your SAML TAI procesing, ensure that the host name for your request URL and ACS URL match. You might have to change the value for your [sso_<id>.sp.acsUrl] TAI custom property, your IdP configuration or the URL to which requests are made. You can also create a new SP in your SAML TAI configuration to handle the alternate host name. If you want to disable this warning message, set the [com.ibm.ws.security.web.saml.acs.hostWarnings] system property to [false] and restart the application server.

CWSML7038W: The SAML Web Single Single Sign-on (SSO) Trust Association Interceptor (TAI) has two assertion consumer service URL custom properties configured that have the same URL path: [{0}] and [{1}]. This condition can cause unexpected behavior at run time. To prevent further issues, all text after <hostname>:<port> must be unique for each [sso_<id>.sp.acsUrl] custom property value.

Explanation

The value for each SAML [sso_<id>.sp.acsUrl] custom property must have a unique URL path. A URL path does not include the protocol and <hostname>:<port> parts of a URL string. For example, although the URL strings for https://somewhere.ibm.com/samlsps/hello/app and https://elsewhere.ibm.com/samlsps/hello/app are different, the URL paths are the same. If two acsUrl entries have the same URL path, when a SAMLResponse is sent to one of the URLs that has a duplicate path, the service provider that is chosen to handle the request will be indeterminate.

Action

Ensure that the URL configured for each of the [sso_<id>.sp.acsUrl] custom properties have unique URL paths, meaning that they have unique text after the <hostname>:<port> part of the URL string.

CWSML7039E: One or more of the properties that are required to decrypt a SAML assertion are missing from the SAML configuration. The required parameters are [{0}].

Explanation

The SAML runtime requires a key to decrypt messages. The runtime is unable to obtain the decrypting key because at least one of the properties that is shown in the message is missing from the SAML configuration.

Action

Ensure that the properties shown in the message are properly configured, then restart the server.

CWSML7040E: A [{0}] error occurred when the runtime attempted to retrieve the [{1}] key from the [{2}] keystore. Check that the configured password is correct.

Explanation

The SAML runtime is unable to retrieve a key from the keystore that is specified in the message.

Action

Ensure that the password for the key that is specified in the message is properly configured in the SAML TAI settings, then restart the server. If the password for the key is correct, retrieve the entire call stack from the FFDC entry that contains this error to get information about the root cause of the error.

CWSML7041E: The [{0}] assertion consumer service URL property is not present in the SAML TAI configuration.

Explanation

The SAML TAI assertion consumer service URL property, sso_<id>.acsUrl, is required and is not present in the SAML TAI configuration.

Action

Ensure that the missing properties that are specified the message are properly configured in the SAML TAI settings, then restart the server.

CWSML7042E: The SAML TAI cannot set the [{0}] character encoding on the inbound request [{2}]: {1}

Explanation

The value for the sso_<id>.sp.charEncoding SAML TAI property overrides the character encoding of the HTTPServletRequest object of the inbound request. The SAML TAI cannot set the character encoding that is shown in the message on an inbound request. The reason for the error is shown after this message.

Action

Make sure that the sso_<id>.sp.charEncoding SAML TAI property is set to a valid value. See the user action for the message that is displayed after this message.

CWSML7043W: The SAML TAI cannot store the HTTP POST parameters of the inbound request into a cookie because they are too large. The request POST parameter length is [{0}]. The maximum length is [{1}].

Explanation

The SAML TAI saves the parameters of the inbound request into a cookie before the request is redirected to the identity provider (IdP) for the user to log in. The IdP sends a SAMLResponse back to the application server after the request is validated. Then, the SAML TAI restores the POST parameters from the cookie to the request before it is sent to the target application. If the SAML TAI cannot store the request POST parameters, the target application is missing the parameters when the authentication is complete.

Action

Do one of the following actions. 1) Send a request with parameters that are within the maximum length. 2) Increase the value for the com.ibm.websphere.security.util.postParamMaxCookieSize global security custom property. 3) Set the value for the com.ibm.websphere.security.util.postParamSaveMethod global security custom property as "Session".

CWSML7044E: The HashMap object that was returned from the AuthnRequestProvider implementation class is null or empty.

Explanation

The AuthnRequestProvider implementation class that is specified by the sso_<id>.sp.login.error.page SAML TAI property did not return a valid HashMap object.

Action

Make sure that your com.ibm.wsspi.security.web.saml.AuthnRequestProvider implementation returns a valid HashMap object that the SAML TAI can use to perform initiated SP-initiated login.

CWSML7045E: The HashMap object that was returned from the AuthnRequestProvider implementation class does not contain the following entries: [{0}]

Explanation

The AuthnRequestProvider implementation class that is specified on the sso_<id>.sp.login.error.page SAML TAI property returned a HashMap object that is missing the required keys, which are specified in the message. These keys are required for proper operation of SAML SP-initiated login.

Action

Make sure that your com.ibm.wsspi.security.web.saml.AuthnRequestProvider implementation returns a valid HashMap object that the SAML TAI can use to perform initiated SP-initiated login.