SAML IdP Metadata import fails with error message “Failed to parse IDP Metadata” due to Profile name having more than 31 characters
40026
Created On 08/08/22 14:12 PM - Last Modified 10/27/23 21:35 PM
Symptom
When trying to import SAML metadata file (Step2), Error message "Failed to parse IDP Metadata" is seen.
Environment
- Palo Alto Firewalls and Panorama.
- Supported PAN-OS / Plugin Version: Any
- Deployment: New
- Certificate Import
- SAML IDP
Cause
- The “Profile Name” is exceeding the 31 character limit.
- "configd.log" display the issue (less mp-log configd.log)
Error: pan_schema_verify_string(pan_schema_verify.c:521): Node can be at most 31 characters, but current length: 32
Error: _pan_schema_verify_node(pan_schema_obj.c:7467): is invalid , node: profile-name near line 1
Resolution
Log in as a Superuser and follow the steps below.
- Export the SAML metadata file from the IDP to an endpoint that the firewall can access. Refer to the IDP documentation.
- On the Firewall, go to the GUI: Device > Server Profiles > SAML Identity Provider.
- Click on the Import button at the bottom of the tab and select the metadata file. Click "OK"
- Go to GUI: Device > Authentication Profile, find the profiles using the old SAML Identity Provider, and replace the old profile name with the new profile name
- Commit the configuration.
- If all the above steps fail, Open a Support case.