InvalidFederatedIdentityActionMessage
Description:
When logging in at oeresource or the sharing platform via Keycloak / TU Wien Identity Provider we see InvalidFederatedIdentityActionMessage, and cannot proceed.
Cause:
The identity providers' X509 certificate expired.
Solution:
- Download the current SAML entity from https://idp.zid.tuwien.ac.at/saml2. For other identity providers see https://eduid.at/entities/idp/
- Go to the keycloak admin console
- Navigate to Identity Providers (left sidebar)
- Choose Vienna University of Technology
- Scroll to Validating X509 Certificates
- Insert X509 certificate from SAML entity and click save
"500 Internal Server Error" @ TU Wien Identity Provider (ZID)
Description:
When logging out at oeresource, the user is not correctly redirected back, but sees a vague "500 Internal Server Error" and is stuck at the identity providers' site.
Cause:
In our case, the single logout endpoint was not passed on to the identity provider correctly.
Solution:
- Go to the keycloak admin console
- Navigate to Identity Providers (left sidebar)
- Choose Vienna University of Technology
- Enable "backchannel logout" and save
