Ping Federate SAML Connection Fails with "Failed to read asymmetric key" Error

When setting up a Ping Federate connection, an error is received on the Security Assertion Markup Language (SAML) Response:

Failed to read asymmetric key

The failed login error includes the following description:

error:1E08010C:DECODER routines::unsupported

• Ping Federate connection
• Security Assertion Markup Language (SAML)
• Failed Login

This error can be caused by configuring Ping Federate to not send the certificate in responses, which causes Auth0 to reject the signature.

If the certificate is included in the SAML response, the Auth0 server uses the certificate from the response to check the signature, as long as the certificate thumbprint matches the one specified in the connection. If the certificate is not in the SAML response, the Auth0 server uses the certificate from options.signingCert to validate the signature.

When the certificate is not sent in the <keyinfo> element in the SAML response, authentication fails on the Auth0 side.

1. Enable the option in Ping Federate to include the certificate in the <keyinfo> element.

2. If the error persists, verify that the uploaded certificates match the ones Ping Federate is sending.

   • NOTE: An HTTP Archive (HAR) file of the full SAML login flow can be decoded to check what is being sent to Auth0.

   • Refer to Ping Federate documentation for options regarding responses that can impact Auth0's ability to read the certificate.

3. If unable to include the certificate in the <keyinfo> element, create a new SAML connection to connect with Ping Federate instead of using the default Ping Federate connection. Refer to Configure PingFederate as SAML Identity Provider for more details.