Search code examples
c#saml-2.0sustainsys-saml2

Sustainsys.Saml2 No cookie preserving state from the request was found

I've run into an issue using Sustainsys.Saml2 library to authenticate to MS Entra using Saml2. This question seems to have been asked many times. I've looked through many online posts with the same issues as me on here and Microsoft and still can't find a solution. I'm either not doing something specific to .NET Framework 4.7.2 or haven't truly found my issue.

I'm getting the following error:

Received message _a80178a3-d538-4b8e-a538-5fbbef823aca contains unexpected InResponseTo "iddbc74838186f4f58a236105450827f37". No cookie preserving state from the request was found so the message was not expected to have an InResponseTo attribute. This error typically occurs if the cookie set when doing SP-initiated sign on have been lost.

Here's what I got:

  1. A .NET Framework 4.7.2 WebForms application
  2. Running app on local IIS
  3. A trusted SSL certificate for the host domain (local.abc.com); we've tried issuing certificate to *.abc.com and local.abc.com and no success (yes we moved them to the Trusted Root Authentication Authority; we even had the same certificate used on our production servers installed on our dev machines just to test
  4. I've added an intercept script to update the SameSite value(s) to nothing or "Unspecified" for the cookies using ht following articles: https://learn.microsoft.com/en-us/aspnet/samesite/csharpwebforms No cookie error in chrome. UnexpectedInResponseToException

This solution works just fine on production, which runs an Azure App Service, but does not work on our local machines.

Thanks for your help.

Solution

  • After testing many different things, I tried to focus on certificates. I was using wildcard certificates like this: *.abc.com. Even with the certificate trusted it was not working.

    Once I created a new certificate for local.abc.com and trusted those, everything worked just fine.

    My next venture, if possible, how can I use a wildcard certificate? We have several websites with subdomains of our abc.com domain, that we'd prefer working with just one vs 10 or 20.