Not able to log in to Jira
Asked by Sairaj Naidu:

Since last Friday only two people unable to access Jira with the screen attachment name "Jirauser".

We login through SAML and in AD the user login is success except in jira but he able to access other application.

Please let us know if you need any more information


Answers:
author: Jon Espen Ingvaldsen Kantega SSO
body: It is the Microsoft add-on which throws an error message at the parsing and validation of the SAML response here. I believe this happens before user record data is retrieved from Jira and that the problem is independent of both how the user records stored and special characters are handled in Jira.

-Jon Espen  
[Kantega SSO](https://kantega-sso.com)


author: Sairaj Naidu
body: Hi,

We found special characters in Display name.

Due to that it is failing.

can you please tell how to solve special characters in Jira.

Thank you,

Sairaj


author: Jon Espen Ingvaldsen Kantega SSO
body: A useful tool for troubleshooting such problems is to use Browser addons that can show the SAML messages. One such tool the SAML Message Decoder for Chrome <https://chrome.google.com/webstore/detail/saml-message-decoder/mpabchoaimgbdbbjjieoaeiibojelbhm>

You could try to install this and see whether there is something suspicious in the SAML request / response pair when the login fails.

-Jon Espen  
[Kantega SSO](https://kantega-sso.com)


author: Sairaj Naidu
body: We are using SAML single sign-on by Microsoft for all users but only two users are not able to login from 10 days and previously there are able to login and working fine for them


author: Jon Espen Ingvaldsen Kantega SSO
body: It appears that the users are sent to OneLogin for authentication, and when they are redirected back to Jira your SSO product denies to accept the SAML response message from OneLogin. The reason in your case is that the signature is not valid.  

Invalid signature can mean you don't have the public key certificate of the IdP so you can't validate its signature. Did you exchange metadata xml files as part of the OneLogin integration?  

It is a bit strange if this only happens for two of your users. Is the the error consistent, and does it always happen when these two users login?  

It looks like you use the native SAML features from Atlassian. I work for Kantega SSO, which provide alternative SSO solutions with more configuration options and user provisioning support. Please reach out if you continue to struggle getting the OneLogin integration right and is interested in evaluating alternative SSO solutions.  

-Jon Espen  
[Kantega SSO](https://kantega-sso.com)


author: Sairaj Naidu
body: 2019-06-27 17:00:39,496 http-nio-8080-exec-47 ERROR anonymous 1020x3171806x1 suuf8t IP,IP /plugins/servlet/samlconsumer \[c.a.p.a.i.web.filter.ErrorHandlingFilter\] Received invalid SAML response: Signature validation failed. SAML Response rejected  
com.atlassian.plugins.authentication.impl.web.saml.provider.InvalidSamlResponse: Received invalid SAML response: Signature validation failed. SAML Response rejected  
at com.atlassian.plugins.authentication.impl.web.saml.provider.impl.OneloginJavaSamlProvider.lambda$extractSamlResponse$1(OneloginJavaSamlProvider.java:89)  
at com.atlassian.plugin.util.ContextClassLoaderSwitchingUtil.runInContext(ContextClassLoaderSwitchingUtil.java:48)  
at com.atlassian.plugins.authentication.impl.web.saml.provider.impl.OneloginJavaSamlProvider.extractSamlResponse(OneloginJavaSamlProvider.java:80)  
at com.atlassian.plugins.authentication.impl.web.saml.SamlConsumerServlet.doPost(SamlConsumerServlet.java:87)  
at javax.servlet.http.HttpServlet.service(HttpServlet.java:661)  
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)  
at com.atlassian.plugin.servlet.DelegatingPluginServlet.service(DelegatingPluginServlet.java:37)  
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)  
at com.atlassian.plugin.servlet.ServletModuleContainerServlet.service(ServletModuleContainerServlet.java:45)  
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)  
... 53 filtered  
at com.atlassian.plugins.authentication.impl.web.filter.ErrorHandlingFilter.doFilter(ErrorHandlingFilter.java:83)  
... 3 filtered  
at com.atlassian.web.servlet.plugin.request.RedirectInterceptingFilter.doFilter(RedirectInterceptingFilter.java:21)  
... 58 filtered  
at com.atlassian.jira.security.JiraSecurityFilter.lambda$doFilter$0(JiraSecurityFilter.java:66)  
... 1 filtered  
at com.atlassian.jira.security.JiraSecurityFilter.doFilter(JiraSecurityFilter.java:64)  
... 36 filtered  
at com.atlassian.jira.servermetrics.CorrelationIdPopulatorFilter.doFilter(CorrelationIdPopulatorFilter.java:30)  
... 10 filtered  
at com.atlassian.web.servlet.plugin.request.RedirectInterceptingFilter.doFilter(RedirectInterceptingFilter.java:21)  
... 4 filtered


author: Jon Espen Ingvaldsen Kantega SSO
body: Do you use a third party SSO add-on to setup SAML in your Jira?

Also, do you see any error messages in you Jira application log related to this? If you do not have access to the Jira server you can use the [LastLog](https://marketplace.atlassian.com/apps/1211604/last-log-for-jira?hosting=server&tab=overview) add-on to expose the logs in the Jira user interface.

Regards,  
Jon Espen  
[Kantega SSO](https://kantega-sso.com)


author: Sairaj Naidu
body: ![Jirauser.png](https://community.atlassian.com/t5/image/serverpage/image-id/59024iF3DCBE8EB089DF29/image-size/large?v=v2&px=999 "Jirauser.png")We can't log you in right nowThis may be for a variety of reasons, we suggest trying again.  
If that doesn't work, contact your JIRA administrator for help.[**Try again**](https://jira01.hclpnp.com/login.jsp?permissionViolation=true&os_destination=/secure/Dashboard.jspa&page_caps=&user_role=USER)


author: Jon Espen Ingvaldsen Kantega SSO
body: Hi [@Sairaj Naidu](/t5/user/viewprofilepage/user-id/3274004)

Do have an error message or screenshot describing their error experience?  

Regards,

Jon Espen

[Kantega SSO](https://kantega-sso.com)


Tags: confluence-server

server