SSO and ADFS

[Jendy_Huang]

Has anyone sucessfully done Marketo SSO with ADFS? The document provided by Marketo was not very helpful. Marketo Support Engineer said that can't help either. 

In particular what should I put under Entity ID? Also, I try to test SSO using this URL: https://login.marketo.com/saml/assertion/<my-munchkin-id>, got "Error processing SAML message. Request was ill-formed in some way."

Any help you can share is greatly appreciated!

Jendy

[Anonymous]

We have one user who is getting an error while he tries to access Marketo production environment by using SSO link. Error message: Error processing SAML message. Request was ill-formed in some way.

Does anyone know why this error occurs?

[Grégoire_Miche2]

We have the same problem and the support cannot help, apparently...

Jendy Huang​, Selin Berber, have you been able to sort this out ?

-Greg

[Ivo_Hanbeukers]

Hi

I got it to work after struggling for 12 hours . I can help you If you still need help.
The documentation form Marketo is not very helpful .

Br.

Ivo Hanbeukers

[Anonymous]

Hi Ivo Hanbeukers,

We got the same error message "Error processing SAML message. Request was ill-formed in some way." when trying using URL https://login.marketo.com/saml/assertion/<my-munchkin-id> . Could you share how you made it work?  Thank you very much!!!

Vivian

[Ivo_Hanbeukers]

Hi Vivian

Check my guide in this post.

Br. Ivo

[Grégoire_Miche2]

Hi Ivo Hanbeukers ,

What post?

-Greg

[Ivo_Hanbeukers]

Hi, I will describe the steps which I did.

If you still have problems you can contact me directly: ivo.hanbeukers@rockwool.com

In Marketo go to the SSO Settings

Enable SAML Sngle Sign-On

Issuer ID and Entity ID are the same in my configuration: http://sts.youradfsserver.com/adfs/services/trust

User ID Location: In Name identifier element of Subject

Name Id Format: urn:oasis:names:tc:SAML:1.1:nameid-format:email

Identity Provider Certificate.: Upload here your certificate from your ADFS server.

Go now to your AFS Server and create a new Relying Party Trust

Enter the data about the relying party manually

Give it a name

Select all the
default settings except for:

Configure URL

Select Enable support for the SAML 2.0 Web SSO protocol

Enter the url:  https://login.marketo.com/saml/assertion/Munchkin Account ID

you can find your Munchkin Account ID in Marketo un intergration -> Munchkin

On the next screen you have to enter the relying party trust identifier: http://saml.marketo.com/sp

On the claim rules window add a rule

Use the claim rule template: Send LDAP Attribute as Claims

Give it a name

Attribute store: Active directory

LDAP Attribute = E-mail-address (This can be different for you depending on the login name you use in Marketo)

Outgoing Claim Type must be: Name ID

[Anonymous]

Ivo, I also haven't been able to make any progress with Marekto support on this and have basically just followed your instructions but seem to be stuck at " Error processing SAML message. Request was ill-formed in some way".

Any chance you have some advice? It would be much appreciated.

[Roger_Walker]

I followed Ivo's instructions and initially I was also still stuck at "Error processing SAML message. Request was ill-formed in some way".

For me, the additionaI step I had to do, to get it working, was to open the properties of the Marketo Relying Party Trust, go to the Advanced tab, and change the Secure hash algorithm to SHA-1.   Using SHA-256 breaks it.