I have set up my SSO configurations and I keep getting this error when I attempt to log in: 'Incoming SAML assertion/response from an issuer for which the SP has no metadata loaded or is wrong'

In an attempt to avoid this error i have created a new key in ET and chose to paste the metadata from my SSO team and i keep getting this error: "Expecting X509Certificate inside the KeyDescriptor element." yet the cert IS inside the KeyDescriptor Element....

Here is the format of my XML of metadata:

<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" ID="SM86a320768a69b3b208c38b22ca810982840e36cc6a" entityID="https://sso.qa.ameriprise.com" validUntil="2042-07-19T21:15:47.077+00:00">
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#SM86a320768a69b3b208c38b22ca810982840e36cc6a">
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>... Digest Value Here...=</ds:DigestValue>
... Signature Value Here...
...CERT Key Details Here...
</ds:Signature><IDPSSODescriptor ID="SM18429cb9f081a2eb8f3be23621118d7ed127c39f8878" WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" validUntil="2042-07-19T21:15:47.077+00:00">
        <KeyDescriptor use="signing">
            <ns1:KeyInfo xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" Id=".... ID here ...">
                        <ns1:X509IssuerName>CN=VeriSign Class 3 International Server CA - G3,OU=Terms of use at https://www.verisign.com/rpa (c)10,OU=VeriSign Trust Network,O=VeriSign\, Inc.,C=US</ns1:X509IssuerName>
                        <ns1:X509SerialNumber>... Serial number ...</ns1:X509SerialNumber>
                    <ns1:X509Certificate>...CERT Key Details Here...</ns1:X509Certificate>
                    <ns1:X509SubjectName>CN=sso.federation.qa.ameriprise.com,OU=For Intranet Use Only,OU=Technical Utilities,O=Ameriprise Financial Inc,L=Minneapolis,ST=Minnesota,C=US</ns1:X509SubjectName>
        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://sso.qa.ameriprise.com/affwebservices/public/saml2sso"/>
        <ns2:Attribute xmlns:ns2="urn:oasis:names:tc:SAML:2.0:assertion" Name="USER_ID" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"/>
        <ns3:Attribute xmlns:ns3="urn:oasis:names:tc:SAML:2.0:assertion" Name="LAST_NAME" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"/>
        <ns4:Attribute xmlns:ns4="urn:oasis:names:tc:SAML:2.0:assertion" Name="FIRST_NAME" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"/>
        <ns5:Attribute xmlns:ns5="urn:oasis:names:tc:SAML:2.0:assertion" Name="EMAIL" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"/>

Any clues?

  • I don't see the cert. All I see in the <X509Certificate> tag is: ...CERT Key Details Here... That is where the certificate goes. This does not appear to be a complete metadata document.
    – Steve J
    Commented Mar 13, 2015 at 12:15
  • I removed the details of the certificate for privacy concerns. Anywhere it says "... Signature Value Here..." or "...CERT Key Details Here..." I have removed on purpose. They exist in the metadata that our SSO team has shared with us.
    – mitchspano
    Commented Mar 13, 2015 at 15:01

1 Answer 1


The error

Incoming SAML assertion/response from an issuer for which the SP has no metadata loaded or is wrong

means the Salesforce Marketing Cloud does not have any metadata stored, or the EntityID of the IDP that's sending the assertion does not match the EntityID of the metadata stored.

Another cause of this is passing the value of Password for the AuthnContextClassRef tag. We require PasswordProtectedTransport as the value. This is username and password over an encrypted channel (such as https). If for some reason PasswordProtectedTransport cannot be sent as a value, then the value of unspecified would have to be used.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .