> Source: [sk182862](https://support.checkpoint.com/results/sk/sk182862)

# sk182862 - SAML Authentication Loop for Remote Access VPN

| Property | Value |
|----------|-------|
| Solution ID | sk182862 |
| Date Created | 2024-12-02 |
| Last Modified | 2025-10-24 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * SAML Tracer: The client continuously authenticates through multiple GET and POST requests, which indicates a possible issues with the authentication flow.
* IKEView Tool: No response from the VPN client in configuration mode, suggests a communication or configuration issue.
* IKEView Tool: No response from the VPN client in configuration mode, implies an authentication process completion without apparent issues.
* `access_log`: The following errors are logged:

  > `xxx.xxx.xxx.xxx - - [14/Nov/2024:21:20:53 +0530] "POST /saml-vpn/spPortal/ACS/Login/example-session-id HTTP/1.1" 303 907
  > xxx.xxx.xxx.xxx - - [14/Nov/2024:21:20:53 +0530] "GET /saml-vpn/spPortal/ServiceProvider?realm=example-realm&session=example-session-id HTTP/1.1" 302 3058
  > `

  Repeated redirects in the log suggest an authentication loop, potentially due to misconfiguration or session errors.
* `error_log`: The following errors are logged:

  > `[Thu Nov 14 21:23:00.116314 2024] [php7:warn] [pid 31183] [client xxx.xxx.xxx.xxx:54992] PHP Warning: Use of undefined constant session - assumed 'session' (this will throw an Error in a future version of PHP) in /opt/CPSamlPortal/phpincs/spPortal/sso.php on line 25, referer:
  > [Thu Nov 14 21:23:00.120916 2024] [php7:notice] [pid 31183] [client xxx.xxx.xxx.xxx:54992] fatal Calling to server failed. Exception: "End of file or no input: 'Operation interrupted or timed out'", referer:
  > [Thu Nov 14 21:23:02.009373 2024] [php7:notice] [pid 16472] [client xxx.xxx.xxx.xxx:54994] PHP Notice: Trying to get property 'authToken' of non-object in /opt/CPSamlPortal/phpincs/simplesamlphp/lib/SimpleSAML/Session.php on line 354, referer:
  > `

  PHP warnings and errors indicate possible issues with undefined constants, server communication failure, and object property access errors.

## Cause

The SAML authentication loop occurs when the Security Management Server runs a version lower than the Gateway. This version mismatch causes the `idp_` tables\* to be missing on the Security Management Server, which are necessary for IDP functionality.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content