Troubleshooting

1. Certificate Trust Issues

1.1. Firefox HSTS Cached Bad Certificate

Symptom

Firefox continues to show certificate error even after replacing the certificate.

Cause

Firefox caches HSTS (HTTP Strict Transport Security) settings, including certificate expectations.

Solution

  1. Close all Firefox windows

  2. Clear Firefox cache and site data for the domain

  3. Or use a private/incognito window for testing

1.2. CA Not Trusted in Firefox

Symptom

Firefox shows "SEC_ERROR_UNKNOWN_ISSUER" even though CA is in system trust store.

Cause

Firefox uses its own certificate store, separate from the system store.

Solution

Import the CA certificate into Firefox:

  1. Settings → Privacy & Security → View Certificates

  2. Authorities tab → Import

  3. Select DOMUS-ROOT-CA.pem

  4. Check "Trust this CA to identify websites"

1.3. Browser Shows "Domain Name Does Not Match"

Symptom

Browser displays certificate warning even though signed by trusted CA.

Cause

Certificate is missing Subject Alternative Name (SAN).

Solution

Regenerate certificate with SAN via Vault PKI:

vault write pki_int/issue/domus-server \
  common_name="hostname.inside.domusdigitalis.dev" \
  alt_names="hostname" \
  ttl="8760h"

2. SAML Authentication Errors

2.1. "Invalid Request" from Keycloak

Symptom

After clicking Log In with Keycloak, browser shows "Invalid Request".

Cause

The Entity ID (Client ID) in Keycloak doesn’t match what ISE sends.

ISE uses format: CiscoISE/<uuid>; NOT: ise-01.inside.domusdigitalis.dev

Solution

  1. Export ISE SP metadata

  2. Find the entityID attribute

  3. Update Keycloak client ID to match exactly

2.2. "Invalid redirect uri" from Keycloak

Symptom

After Keycloak authentication, browser shows "Invalid redirect uri".

Cause

ISE sends Assertion Consumer Service URL with port 8443, but Keycloak’s Valid Redirect URIs don’t include the port.

Solution

In Keycloak, update Valid redirect URIs to:

https://ise-01.inside.domusdigitalis.dev:8443/*

2.3. "Access Denied" After Successful Authentication

Symptom

User logs in to Keycloak successfully, but ISE shows "Access denied".

ISE Log
ssh admin@ise-01
show logging application ise-psc.log tail | include SAML

Shows: SAML authentication failed: ISE group not configured for IDP group(s): [group-name]

Solution

  1. Check exact group name in log

  2. In ISE: Administration → Identity Management → External Identity Sources → SAML Id Providers → Groups

  3. Add mapping with exact group name

2.4. Case Sensitivity in Group Mapping

Symptom

Group mapping configured but user still gets "Access denied".

Cause

ISE Admin Group names are case-sensitive.

Solution

Use exact case:

Correct Incorrect

Super Admin

super admin

Read Only Admin

read only admin

Helpdesk Admin

helpdesk admin

3. Keycloak Container Issues

3.1. H2 Database AccessDeniedException

Symptom
ERROR: Failed to obtain JDBC connection
Caused by: java.nio.file.AccessDeniedException: /opt/keycloak/data/h2
Cause

Using docker run …​ import with volume mounts when PostgreSQL is configured.

Solution

Use REST API import method instead. See Realm Management.

3.2. Container Won’t Start After Reboot

Symptom

Container exits immediately after docker start keycloak.

Cause

SELinux context issues on Fedora/RHEL.

Solution
ssh keycloak-01 'sudo chcon -Rt svirt_sandbox_file_t /opt/keycloak'
ssh keycloak-01 'sudo docker start keycloak'

3.3. Certificate Permission Denied

Symptom
java.io.FileNotFoundException: /opt/keycloak/conf/key.pem (Permission denied)
Cause

Incorrect ownership. Keycloak container runs as UID 1000.

Solution
ssh keycloak-01 'cd /opt/keycloak/conf && \
  sudo chown 1000:1000 cert.pem key.pem && \
  sudo chmod 444 cert.pem && \
  sudo chmod 400 key.pem && \
  sudo chcon -t svirt_sandbox_file_t cert.pem key.pem'

4. Metadata Issues

4.1. ISE Cannot Fetch Keycloak Metadata

Symptom

ISE shows error when importing IdP metadata URL.

Possible Causes

  1. ISE cannot reach Keycloak (firewall)

  2. ISE doesn’t trust Keycloak’s certificate

  3. Keycloak realm doesn’t exist

Solutions

  1. Test connectivity from ISE CLI:

    ssh admin@ise-01
# Cannot curl from ISE CLI directly

  2. Import CA to ISE trust store: Administration → System → Certificates → Trusted Certificates

  3. Use file import instead of URL import

4.2. SAML Assertion Signature Invalid

Symptom

ISE logs show "Invalid signature" or "Signature verification failed".

Possible Causes

  1. Keycloak signing certificate changed

  2. Metadata not updated after certificate change

  3. Clock skew between ISE and Keycloak

Solutions

  1. Re-import Keycloak metadata in ISE

  2. Check NTP synchronization on both systems

  3. Verify assertion lifespan (default 300 seconds)

5. TAC Support

If issues persist after following this guide, open a Cisco TAC case for ISE SAML troubleshooting support.

Gather before opening TAC case: * ISE version and patch level * SAML logs from ise-psc.log * Keycloak version * Network capture of SAML flow (if possible)