SAML IdP Metadata import fails with error message “Failed to parse IDP Metadata” due to Profile name having more than 31 characters

SAML IdP Metadata import fails with error message “Failed to parse IDP Metadata” due to Profile name having more than 31 characters

40026
Created On 08/08/22 14:12 PM - Last Modified 10/27/23 21:35 PM


Symptom


When trying to import SAML metadata file (Step2), Error message "Failed to parse IDP Metadata" is seen.

SAML Identify Provider server profile import

 


Environment


  • Palo Alto Firewalls and Panorama.
  • Supported PAN-OS / Plugin Version: Any
  • Deployment: New
  • Certificate Import
  • SAML IDP


Cause


  • The “Profile Name” is exceeding the 31 character limit.
  • "configd.log" display the issue (less mp-log configd.log)
Error:  pan_schema_verify_string(pan_schema_verify.c:521): Node can be at most 31 characters, but current length: 32 
Error:  _pan_schema_verify_node(pan_schema_obj.c:7467): is invalid , node: profile-name near line 1

 


Resolution


Log in as a Superuser and follow the steps below.
  1. Export the SAML metadata file from the IDP to an endpoint that the firewall can access. Refer to the IDP documentation.
  2. On the Firewall, go to the GUI: Device > Server Profiles > SAML Identity Provider.
  3. Click on the Import button at the bottom of the tab and select the metadata file. Click "OK"
  4. Go to GUI: Device > Authentication Profile, find the profiles using the old SAML Identity Provider, and replace the old profile name with the new profile name 
  5. Commit the configuration.
  6. If all the above steps fail, Open a Support case.


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wlFiCAI&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language