Wallix with Keycloak SAML #36318

gabardyne · 2025-01-09T10:01:32Z

gabardyne
Jan 9, 2025

Hello,
I'm trying to configure Wallix with Keycloak with SAML Protocol.
I've created the client with an XML file from Wallix.
Certificate are the same on both sides, but i'm still getting this error:

2025-01-09 10:24:43,782 ERROR [org.keycloak.protocol.saml.SamlService] (executor-thread-427) request validation failed: org.keycloak.common.VerificationException: SigAlg was null
        at org.keycloak.protocol.saml.SamlProtocolUtils.verifyRedirectSignature(SamlProtocolUtils.java:154)
        at org.keycloak.protocol.saml.SamlProtocolUtils.verifyRedirectSignature(SamlProtocolUtils.java:144)
        at org.keycloak.protocol.saml.SamlService$RedirectBindingProtocol.verifySignature(SamlService.java:816)
        at org.keycloak.protocol.saml.SamlService$BindingProtocol.handleSamlRequest(SamlService.java:302)
        at org.keycloak.protocol.saml.SamlService$BindingProtocol.execute(SamlService.java:700)
        at org.keycloak.protocol.saml.SamlService.redirectBinding(SamlService.java:868)
        at org.keycloak.protocol.saml.SamlService$quarkusrestinvoker$redirectBinding_f029009a8f864880d0a24aa96e434ce2f5c9e801.invoke(Unknown Source)
        at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
        at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)
        at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)
        at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:582)
        at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
        at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
        at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
        at java.base/java.lang.Thread.run(Thread.java:840)

2025-01-09 10:24:43,782 WARN  [org.keycloak.events] (executor-thread-427) type="LOGIN_ERROR", realmId="cd3496f3xxxxxx", clientId="null", userId="null", ipAddress="x.x.x.x", error="invalid_signature"

My Keycloak Version is 24.0.5.

Is there an option in the client configuration that i'm missing?

Regards,

Gab

rgrente · 2025-03-04T06:24:09Z

rgrente
Mar 4, 2025

Hello,

Maybe it's too late, but : Wallix does not sign authnrequests (didn't find how to enable it), so you have to disable signature validation on Keycloak. On the client, disable client signature in the Keys tab.

Regards

1 reply

gabardyne Mar 4, 2025
Author

Hello,

Thanks for the answer.
Indeed, we've open a case to Wallix support, and then can't activate authnrequests signin. They have to came back to us with their R&D solution, but nothing yet.
In the meantime, we've disabled it.

Regards,
Gab

Navigation Menu

Repository navigation

Wallix with Keycloak SAML #36318

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Wallix with Keycloak SAML #36318

Uh oh!

gabardyne Jan 9, 2025

Replies: 1 comment · 1 reply

Uh oh!

rgrente Mar 4, 2025

Uh oh!

gabardyne Mar 4, 2025 Author

gabardyne
Jan 9, 2025

Replies: 1 comment 1 reply

rgrente
Mar 4, 2025

gabardyne Mar 4, 2025
Author