On SRX devices configured for Juniper Secure Connect with SAML authentication, users are unable to authenticate. The SAML assertion is received successfully from the Identity Provider (IdP) but authentication fails with type = fail.

The following error is observed in the firewall authentication log:

saml_auth_create_saml_provider: 414 cert id is not present

When the SRX receives and validates the SAML assertion from the IdP, the SP certificate is required to initialize the SAML provider object. Without it, the provider fails to load and assertion validation cannot proceed — even though the assertion was successfully received.

Configure the Local certificate in the service-provider configuration:

set access saml service-provider vSRX-SP sp-certificate <local-certificate>