Issue

After upgrading the SAML20 module to version 4.2.4, logging in to an application that runs on Microsoft SQL Server/Azure SQL is no longer possible. Every new single sign-on (SSO) login fails with an error similar to the following:

SAML_SSO: Failed to commit

The issue starts as soon as one row with an empty (NULL) AssertionId exists in the SAML20$SAMLRequest table. This can happen when any of the following occurs:

• A login is interrupted before the SAML response is processed.
• Two logins run at the same time.
• A logout occurs. Logout requests never get an AssertionId.
• A login is attempted with an inactive account or an account that does not exist in the application.

All logins remain blocked until the row with the NULL AssertionId is removed. The issue returns as soon as a new row with a NULL value is created. 

Environment

SAML v4.2.4

Cause

SAML20 version 4.2.4 adds a unique validation rule to the SAML20.SAMLRequest.AssertionId attribute (String, length 255). Because of this rule, Mendix creates a unique index on the AssertionId column in the database.

On SQL Server, a unique index treats NULL values as equal, so the column can contain only one row with a NULL value. The SAML20 module creates SAMLRequest objects without an AssertionId in these cases:

• At the start of every login. The LoginHandler creates the request through SAMLUtil. The AssertionId is filled in later by the ArtifactHandler, after the response has been processed. 
• For logout requests, which never get an AssertionId.

When one row with a NULL AssertionId already exists, the next commit of a new SAMLRequest object violates the unique index and fails. As a result, all later logins are blocked.

Solution / Workaround

A fix in the SAML20 module is under investigation. Until a fixed version is released, use the following workaround.

1. In Studio Pro, open the domain model of the SAML20 module.
2. Open the properties of the SAMLRequest entity and go to the Validation rules tab.
3. Delete the unique validation rule on the AssertionId attribute.
4. Commit the change and redeploy the application. During deployment, Mendix removes the unique index from the database column, and logins work again.

Note: This change is made inside a Marketplace module. Updating the SAML20 module overwrites this change. Check whether the new version still contains the unique rule, and apply the workaround again if needed. For multiple applications that use SAML20 4.2.4 on SQL Server, apply the workaround to each of them.

Additional information

Mendix documentation: SQL Server

Marketplace content: SAML module