Overview :

Authentication: ADFS SAML Single Sign-On (SSO)

ID4037: The key needed to verify the signature could not be resolved from the security key identifier. Ensure that the Security Token Resolver is populated with the required key.

This error generally occurs when AutomationEdge is unable to validate the SAML response received from ADFS due to one or more of the following:

• Certificate mismatch between AutomationEdge and ADFS
• Incorrect Entity ID (Identifier)
• Incorrect SAML claim mappings
• Outdated Federation Metadata (descriptor.xml)
• Incorrect Single Logout configuration

Prerequisites :

Before configuring SSO, obtain the following information from ADFS:

• Identity Provider Metadata (descriptor.xml)
• Client ID
• Redirect URI(s)
• Keystore File
• Keystore Alias
• Keystore Password
• RSA Certificate (.crt)

Note:
To generate a Self-Signed or CA-signed certificate, refer to the Keystore and Certificate Generation guide.

Configure the Relying Party Trust

1. Open AD FS Management.
2. Navigate to Relying Party Trusts.
3. Click Add Relying Party Trust.
4. Select Claims Aware.
5. Choose Enter data about the relying party manually.
6. Enter a display name.
7. Skip the certificate configuration (it will be configured later).
8. Enable SAML 2.0 WebSSO Protocol.
9. Enter the AutomationEdge Redirect URL (HTTPS).

Example:

https://<AutomationEdge-Server>/aeui/index.jsp

10. Configure the Identifier (Entity ID).
11. Complete the wizard.
12. Select Configure Claims Issuance Policy before closing the wizard.

Validation

Verify that the Entity ID (Identifier) configured in AutomationEdge is exactly the same as the Identifier configured in the ADFS Relying Party Trust.

Common Issue

The Entity ID configured in AutomationEdge does not match the Identifier configured in ADFS.

Resolution

Update the Identifier in AutomationEdge so that it exactly matches the Identifier configured in ADFS.

Configure Claim Rules

Rule 1 – Send LDAP Attributes as Claims

Select:

• Claim Rule Template
  • Send LDAP Attributes as Claims

Attribute Store:

Active Directory

Configure the following mappings:

Rule 2 – Transform Incoming Claim

Select:

• Incoming Claim Type
  • UPN
• Outgoing Claim Type
  • Name ID
• Outgoing Name ID Format
  • Unspecified

Finish the wizard.

Validation

AutomationEdge expects the outgoing claim names exactly as shown below.

The values are case-sensitive.

username
emailAddress
firstName
lastName

Common Issue

Claim names were configured with incorrect capitalization or different names.

Examples:

UserName
Email
Firstname
Last_Name

Resolution

Update the claim names to:

username
emailAddress
firstName
lastName

Upload the RSA Certificate

1. Open Relying Party Trust Properties.
2. Navigate to the Signature tab.
3. Click Add.
4. Upload the RSA certificate.
5. Click Apply.

Upload the Token Signing Certificate

1. Open AD FS Management.
2. Navigate to Certificates.
3. Upload the Token Signing Certificate.
4. If multiple certificates exist:
   • Right-click the correct certificate.
   • Select Set as Primary.

Validation

Verify that:

• The Token Signing Certificate configured in ADFS is the same certificate configured in AutomationEdge.
• The correct certificate is marked as Primary.

Common Issue

AutomationEdge and ADFS were configured with different certificates.

As a result, AutomationEdge could not verify the SAML signature, resulting in the ID4037 error.

Resolution

• Regenerate the certificates if necessary.
• Upload the same certificates to both AutomationEdge and ADFS.
• Set the correct Token Signing Certificate as Primary.
• Re-test SSO.

Configure the Single Logout Endpoint

Navigate to:

Relying Party Trust → Properties → Endpoints

Add:

Endpoint Type

SAML Logout

Binding

POST

Trusted URL

https://<ADFS-Server>/adfs/ls/?wa=wsignout1.0

Response URL

https://<AutomationEdge-Server>/aeui/logout.jsp

Save the configuration.

Validation

Verify that the Logout URL configured in AutomationEdge matches the Logout endpoint configured in ADFS.

Common Issue

Incorrect Single Logout URL.

Resolution

Update the Logout URL to:

https://<ADFS-Server>/adfs/ls/?wa=wsignout1.0

WS-Federation Configuration

The original ADFS configuration documentation includes a WS-Federation endpoint.

However, when only SAML authentication is being used, WS-Federation is not required.

Common Issue

WS-Federation endpoint configured unnecessarily.

Resolution

Remove the WS-Federation endpoint if only SAML authentication is used.

Note:
Configure WS-Federation only if your authentication flow explicitly requires it.

Verify Secure Hash Algorithm

Navigate to:

Relying Party Trust
    → Properties
        → Advanced

Ensure the Secure Hash Algorithm is configured as:

SHA-256

Update descriptor.xml

Whenever certificates are regenerated, download a fresh Federation Metadata file.

Open PowerShell:

Get-AdfsEndpoint

Locate the Federation Metadata endpoint.

Open the URL in a browser.

Save the XML as:

descriptor.xml

Upload the updated descriptor.xml into the AutomationEdge SSO configuration.

Validation

Whenever the Token Signing Certificate changes, upload a new descriptor.xml to AutomationEdge.

Common Issue

AutomationEdge was using an outdated Federation Metadata file.

Resolution :

Download a fresh descriptor.xml and upload it into the AutomationEdge SSO configuration.

AutomationEdge SSO Configuration

Configure the following under Settings → Single Sign-On:

• Identity Provider Metadata (descriptor.xml)
• Client ID
• Redirect URI
• Entity ID
• Certificate
• Keystore
• Alias
• Password

Save the configuration.

On the login page:

1. Click Sign in with SSO.
2. Enter the Organization Code.
3. Authenticate using ADFS.

Validation Checklist

Before testing SSO, verify the following:

Resolution Summary :

The issue was resolved by performing the following actions:

• Regenerated the certificates and synchronized them between AutomationEdge and ADFS.
• Uploaded the correct Token Signing Certificate in ADFS.
• Set the correct Token Signing Certificate as Primary.
• Corrected the Entity ID mismatch.
• Corrected the outgoing claim names to:
  • username
  • emailAddress
  • firstName
  • lastName
• Updated the Single Logout URL.
• Removed the unnecessary WS-Federation configuration.
• Downloaded and uploaded the latest descriptor.xml after certificate regeneration.

Result 

After applying the above configuration changes:

• AutomationEdge successfully validated the SAML response received from ADFS.
• The ID4037 signature verification error was resolved.
• Users were able to authenticate successfully using ADFS SAML Single Sign-On (SSO).
• SSO authentication completed successfully without further signature verification failures.
•