You're viewing **Apigee Edge** documentation.  
[Go to the
**Apigee X** documentation](http://cloud.google.com/apigee/docs/api-platform/reference/policies/saml-assertion-policy). info

> [!NOTE]
> Was this troubleshooting playbook helpful? Please let us know by clicking [Send Feedback]().

## SourceNotConfigured

### Error Message

Deployment of the API proxy through either the Edge UI or Edge management
API fails with this error message:

```
Error Deploying Revision revision_number to environment
ValidateSAMLAssertion[policy_name]: Source is not correctly configured.
```

### Example Error Message

    Error Deploying Revision 2 to test
    ValidateSAMLAssertion[Validate-SAML-Assertion-1]: Source is not correctly configured.

### Example Error Screenshot

![](https://docs.apigee.com/static/api-platform/images/saml-assert-error-1.png)

### Cause

The deployment of the API Proxy fails with this error if one or more of
the following elements of the Validate SAML Assertion policy is not
defined or empty: `<Source>`, `<XPath>`, `<Namespaces>`, `<Namespace>`.

For example, if you miss the `<XPath>` element or leave the `<Source>`
element or its entities empty, then the deployment of the API proxy fails.

### Diagnosis

1. Identify the failed Validate SAML Assertion policy name from the
   error message. For example, in the following error the Validate
   SAML Assertion policy name is `Validate-SAML-Assertion-1`.

       ValidateSAMLAssertion[Validate-SAML-Assertion-1]: Source is not correctly configured.

2. Examine the failed Validate SAML Assertion policy XML. Check if one
   or more of the following elements of the policy is missing or empty:
   `<Source>`, `<XPath>`, `<Namespaces>`, `<Namespace>`. If so, that
   could be the cause of the error.

   For example, the following policy has an empty `<Namespaces>` element
   under the `<Source>` element:

       <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
       <ValidateSAMLAssertion name="SAML" ignoreContentType="false">
         <Source name="request">
           <Namespaces></Namespaces>
          </Source>
          <Description/>
        <TrustStore>ref://TrustStoreName</Truststore>
        <RemoveAssertion>false</RemoveAssertion>
       </ValidateSAMLAssertion>

3. In the above example, the `<Namespaces>` element is empty, therefore
   you get the error:

       ValidateSAMLAssertion[Validate-SAML-Assertion-1]: Source is not correctly configured.

### Resolution

Ensure that values of the `<Source>` element are configured correctly
with the `<Namespaces>` element and its child element `<Namespace>`.
You also need to ensure the `<XPath>` element is defined and non-empty.

To correct the example Validate SAML Assertion policy shown above, you
could add the `<Namespace>` elements as well as `<XPath>`:

    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    <ValidateSAMLAssertion name="SAML" ignoreContentType="false">
      <Source name="request">
        <Namespaces>
          <Namespace prefix='soap'>http://schemas.xmlsoap.org/soap/envelope/</Namespace>
          <Namespace prefix='wsse'>http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd</Namespace>
          <Namespace prefix='saml'>urn:oasis:names:tc:SAML:2.0:assertion</Namespace>
        </Namespaces>
        <XPath>/soap:Envelope/soap:Header/wsse:Security/saml:Assertion</XPath>
      </Source>
       <Description/>
    <TrustStore>ref://TrustStoreName</Truststore>
    <RemoveAssertion>false</RemoveAssertion>
    </ValidateSAMLAssertion>

## TrustStoreNotConfigured

### Error Message

Deployment of the API proxy through either the Edge UI or Edge management
API fails with this error message:

```
Error Deploying Revision revision_number to environment
ValidateSAMLAssertion[[Ljava.lang.Object;@object]: Trust store is not correctly configured.
```

### Example Error Message

    Error Deploying Revision 2 to test
    ValidateSAMLAssertion[[Ljava.lang.Object;@39537262]: Trust store is not correctly configured.

### Example Error Screenshot

![](https://docs.apigee.com/static/api-platform/images/saml-assert-error-2.png)

### Cause

If the `<TrustStore>` element is empty or not specified in the
ValidateSAMLAssertion policy, then the deployment of the API
proxy fails. A valid Trust Store is required.

### Diagnosis

1. Examine all the Validate SAML Assertion policies in the specific
   API Proxy where the failure has occurred. If there is any Validate
   SAML Assertion policy in which the `<TrustStore>` element is empty
   or not specified, then that's the cause of the error.

       <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
       <ValidateSAMLAssertion name="SAML" ignoreContentType="false">
        <Source name="request">
           <Namespaces>
             <Namespace prefix='soap'>http://schemas.xmlsoap.org/soap/envelope/</Namespace>
             <Namespace prefix='wsse'>http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd</Namespace>
             <Namespace prefix='saml'>urn:oasis:names:tc:SAML:2.0:assertion</Namespace>
           </Namespaces>
           <XPath>/soap:Envelope/soap:Header/wsse:Security/saml:Assertion</XPath>
         </Source>
           <Description/>
           <TrustStore/>
         <RemoveAssertion>false</RemoveAssertion>
       </ValidateSAMLAssertion>

### Resolution

Ensure that the element `<TrustStore>` is always specified and
non-empty within the Validate SAML Assertion policy. The `<TrustStore>`
name should match the name of a valid TrustStore
that exists in all the environments to which you are attempting to deploy
a proxy.

To correct the above example, you can specify the `<TrustStore>`
element with a valid value.

    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    <ValidateSAMLAssertion name="SAML" ignoreContentType="false">
      <Source name="request">
        <Namespaces>
          <Namespace prefix='soap'>http://schemas.xmlsoap.org/soap/envelope/</Namespace>
          <Namespace prefix='wsse'>http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd</Namespace>
          <Namespace prefix='saml'>urn:oasis:names:tc:SAML:2.0:assertion</Namespace>
        </Namespaces>
        <XPath>/soap:Envelope/soap:Header/wsse:Security/saml:Assertion</XPath>
      </Source>
      <TrustStore>TrustStoreName</TrustStore>
      <RemoveAssertion>false</RemoveAssertion>
    </ValidateSAMLAssertion>

Refer to [Truststores and Keystores](https://docs.apigee.com/api-platform/system-administration/keystores-and-truststores) for more information on how to use Truststore.

## NullKeyStore

### Error Message

Deployment of the API proxy through either the Edge UI or Edge
management API fails with this error message:

```
Error Deploying Revision revision_number to environment
Assertion KeyStore name cannot be null.
```

### Example Error Message

    Error Deploying Revision 4 to test
    Assertion KeyStore name cannot be null.

### Example Error Screenshot

![](https://docs.apigee.com/static/api-platform/images/saml-assert-error-3.png)

### Cause

If the child element `<Name>` is empty or not specified in the
`<Keystore>` element of GenerateSAMLAssertion policy, then the
deployment of the API proxy fails. A valid Keystore name is required.

### Diagnosis

1. Examine all the Generate SAML Assertion policies in the specific
   API Proxy where the failure has occurred. If there is any Generate
   SAML Assertion policy in which the child element `<Name>` is
   empty or not specified in the `<Keystore>` element, then that's
   the cause of the error.

   The following Generate SAML Assertion policy has an empty child
   element `<Name>` in the `<Keystore>` element:

       <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
       <GenerateSAMLAssertion name="SAML" ignoreContentType="false">`
         <CanonicalizationAlgorithm />
         <Issuer ref="reference">Issuer name</Issuer>
         <KeyStore>
           <Name></Name>
           <Alias ref="reference">alias</Alias>
         </KeyStore>
         <OutputVariable>
           <FlowVariable>assertion.content</FlowVariable>
           <Message name="request">
             <Namespaces>
               <Namespace prefix="test">http://www.example.com/test</Namespace>
             </Namespaces>
             <XPath>/envelope/header</XPath>
           </Message>
         </OutputVariable>
         <SignatureAlgorithm />
         <Subject ref="reference">Subject name</Subject>
         <Template ignoreUnresolvedVariables="false">
           <!-- A lot of XML goes here, in CDATA, with {} around
                each variable -->
         </Template>
       </GenerateSAMLAssertion>

### Resolution

Ensure that the child element `<Name>` is always specified and
non-empty within the `<Keystore>` element of the Generate SAML Assertion
policy.

To correct the above example, you can specify the `<Name>` element correctly
as well as ensure that a valid value is specified to the `<Alias>` element.

    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    <GenerateSAMLAssertion name="SAML" ignoreContentType="false">
      <CanonicalizationAlgorithm />
      <Issuer ref="reference">Issuer name</Issuer>
      <KeyStore>
        <Name ref="reference">keystorename</Name>
        <Alias ref="reference">alias</Alias>
      </KeyStore>
      <OutputVariable>
        <FlowVariable>assertion.content</FlowVariable>
        <Message name="request">
          <Namespaces>
            <Namespace prefix="test">http://www.example.com/test</Namespace>
          </Namespaces>
          <XPath>/envelope/header</XPath>
        </Message>
      </OutputVariable>
      <SignatureAlgorithm />
      <Subject ref="reference">Subject name</Subject>
      <Template ignoreUnresolvedVariables="false">
        <!-- A lot of XML goes here, in CDATA, with {} around
             each variable -->
      </Template>
    </GenerateSAMLAssertion>

Refer to examples from [Code Samples in SAMLAssertion Policy Reference Article](https://docs.apigee.com/api-platform/reference/policies/saml-assertion-policy#samples).

## NullKeyStoreAlias

### Error Message

Deployment of the API proxy through either the Edge UI or Edge management
API fails with this error message:

```
Error Deploying Revision revision_number to environment
Assertion KeyStore alias cannot be null.
```

### Example Error Message

    Error Deploying Revision 4 to test
    Assertion KeyStore alias cannot be null.

### Example Error Screenshot

![](https://docs.apigee.com/static/api-platform/images/saml-assert-error-4.png)

### Cause

If the child element `<Alias>` is empty or not specified in the
`<Keystore>` element of Generate SAML Assertion policy, then the
deployment of the API proxy fails. A valid Keystore alias is required.

### Diagnosis

1. Examine all the Generate SAML Assertion policies in the specific
   API Proxy where the failure has occurred. If there is any Generate
   SAML Assertion policy in which the child element `<Alias>` is
   empty or not specified in the `<Keystore>` element, then that's
   the cause of the error.

   The following Generate SAML Assertion policy has an empty child
   element `<Alias>` in the `<Keystore>` element:

       <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
       <GenerateSAMLAssertion name="SAML" ignoreContentType="false">`
         <CanonicalizationAlgorithm />
         <Issuer ref="reference">Issuer name</Issuer>
         <KeyStore>
           <Name ref="reference">keystorename</Name>
           <Alias></Alias>
         </KeyStore>
         <OutputVariable>
           <FlowVariable>assertion.content</FlowVariable>
           <Message name="request">
             <Namespaces>
               <Namespace prefix="test">http://www.example.com/test</Namespace>
             </Namespaces>
             <XPath>/envelope/header</XPath>
           </Message>
         </OutputVariable>
         <SignatureAlgorithm />
         <Subject ref="reference">Subject name</Subject>
         <Template ignoreUnresolvedVariables="false">
           <!-- A lot of XML goes here, in CDATA, with {} around
                each variable -->
         </Template>
       </GenerateSAMLAssertion>

### Resolution

Ensure that the child element `<Name>` is always specified and non-empty
within the `<Keystore>` element of the Generate SAML Assertion policy.

To correct the above example, you can specify the `<Alias>` element
correctly as well as ensure that a valid value is specified to the
`<Name>` element.

    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    <GenerateSAMLAssertion name="SAML" ignoreContentType="false">
      <CanonicalizationAlgorithm />
      <Issuer ref="reference">Issuer name</Issuer>
      <KeyStore>
        <Name ref="reference">keystorename</Name>
        <Alias ref="reference">alias</Alias>
      </KeyStore>
      <OutputVariable>
        <FlowVariable>assertion.content</FlowVariable>
        <Message name="request">
          <Namespaces>
            <Namespace prefix="test">http://www.example.com/test</Namespace>
          </Namespaces>
          <XPath>/envelope/header</XPath>
        </Message>
      </OutputVariable>
      <SignatureAlgorithm />
      <Subject ref="reference">Subject name</Subject>
      <Template ignoreUnresolvedVariables="false">
        <!-- A lot of XML goes here, in CDATA, with {} around
             each variable -->
      </Template>
    </GenerateSAMLAssertion>

Refer to examples from [Code Samples in SAMLAssertion Policy Reference Article](https://docs.apigee.com/api-platform/reference/policies/saml-assertion-policy#samples).

## NullIssuer

### Error Message

Deployment of the API proxy through either the Edge UI or Edge management
API fails with this error message:

```
Error Deploying Revision revision_number to environment
Assertion Issuer cannot be null.
```

### Example Error Message

    Error Deploying Revision 4 to test
    Assertion Issuer cannot be null.

### Example Error Screenshot

![](https://docs.apigee.com/static/api-platform/images/saml-assert-error-5.png)

### Cause

If the `<Issuer>` element is empty or not specified in the Generate SAML
Assertion policy, then the deployment of the API proxy fails. A valid
`<Issuer>` value is required.

### Diagnosis

1. Examine all the Generate SAML Assertion policies in the specific API
   Proxy where the failure has occurred. If there is any Generate SAML
   Assertion policy in which the `<Issuer>` element is empty or not
   specified, then that's the cause of the error.

   The following Generate SAML Assertion policy has an empty `<Issuer>` element:

       <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
       <GenerateSAMLAssertion name="SAML" ignoreContentType="false">`
         <CanonicalizationAlgorithm />
         <Issuer></Issuer>
         <KeyStore>
           <Name ref="reference">keystorename</Name>
           <Alias ref="reference">alias</Alias>
         </KeyStore>
         <OutputVariable>
           <FlowVariable>assertion.content</FlowVariable>
           <Message name="request">
             <Namespaces>
               <Namespace prefix="test">http://www.example.com/test</Namespace>
             </Namespaces>
             <XPath>/envelope/header</XPath>
           </Message>
         </OutputVariable>
         <SignatureAlgorithm />
         <Subject ref="reference">Subject name</Subject>
         <Template ignoreUnresolvedVariables="false">
           <!-- A lot of XML goes here, in CDATA, with {} around
                each variable -->
         </Template>
       </GenerateSAMLAssertion>

### Resolution

Ensure that the `<Issuer>` element is always specified and non-empty in
the Generate SAML Assertion policy.

To correct the above example, specify the `<Issuer>` element correctly:

    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    <GenerateSAMLAssertion name="SAML" ignoreContentType="false">
      <CanonicalizationAlgorithm />
      <Issuer ref="reference">Issuer name</Issuer>
      <KeyStore>
        <Name ref="reference">keystorename</Name>
        <Alias ref="reference">alias</Alias>
      </KeyStore>
      <OutputVariable>
        <FlowVariable>assertion.content</FlowVariable>
        <Message name="request">
          <Namespaces>
            <Namespace prefix="test">http://www.example.com/test</Namespace>
          </Namespaces>
          <XPath>/envelope/header</XPath>
        </Message>
      </OutputVariable>
      <SignatureAlgorithm />
      <Subject ref="reference">Subject name</Subject>
      <Template ignoreUnresolvedVariables="false">
        <!-- A lot of XML goes here, in CDATA, with {} around
             each variable -->
      </Template>
    </GenerateSAMLAssertion>

Refer to examples from [Code Samples in SAMLAssertion Policy Reference Article](https://docs.apigee.com/api-platform/reference/policies/saml-assertion-policy#samples).