Troubleshoot Certificates for SAML with AD FS and Umbrella

Introduction

This document describes whether or not it is possible to change just the certificate for SAML with AD FS and Umbrella.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on Cisco Umbrella.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Problem

If you are using SAML to integrate your Umbrella Dashboard logins with Active Directory Federation Services (AD FS), occasionally you can have a requirement to change the certificate being used.

If this certificate has already been changed in ADFS, your Dashboard users are likely to see an error similar to this screenshot when trying to log into the Dashboard:

"Signature validation failed. SAML Response rejected."

360001725103

Solution

The certificate information is incorporated in the metadata that is taken from your ADFS environment and uploaded to the Umbrella Dashboard during the SAML setup. Unfortunately, there is no way to change just the certificate. 

You are also unable to disable SAML because you cannot be able to log into the Dashboard. At this stage, it is best to contact Cisco Umbrella Support, who can quickly disable the SAML integration for you.

Note: When SAML is disabled, ALL Dashboard users receive a password reset email in order to allow them to regain access to the Dashboard. You must inform them about this email before Cisco Umbrella Support disables the integration.

You can then run through the standard SAML setup steps to export the metadata from ADFS and import this into the Dashboard once again when setting SAML up again.