title: Error on Viewstate MAC during SSO to be blamed on service provider or principal?
body: <p>I have ASP.NET (4.5) Web Forms application in C#. My application is not hosted in neither in a web farm nor in a cluster. </p>
  
  <p>My application (principal) is responsible to create a SAML message for SSO and send it with a POST method to a service party endpoint (SAMLhandler.aspx) which is another ASP.NET application.</p>
  
  <p>I cannot check the service party endpoint and therefore I have to rely on the error messages they send to me. Every time I attempt to send a SAML message the following error is given: </p>
  
  <blockquote>
    <p>Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that  configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster. </p>
  </blockquote>
  
  <p>In my page the <code>EnableViewStateMac="false"</code> and I set in IIS a fixed machine key, as already seen in other solutions found on the web. I would like to know whether the error is because of something wrong in my application or it is the service provider which has to fine tune something on its side. Anybody has ever had such issue?</p>
  
  <p>UPDATE:</p>
  
  <p>Here you have Request and Response taken from a SAML sniffer (that identifies my SAML message as valid)</p>
  
  <pre><code>POST https://www.serviceprovider.com/SAMLhandler.aspx HTTP/1.1 
  Host: www.serviceprovider.com 
  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0 
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
  Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 
  Referer: https://myApp.com 
  Cookie: OTDefaultLang=en; Login=LoginURL=http%253A%2F%2Fwww%2Eserviceprovider%2Ecom%2Fdefault%2Easp; brandingid=9; OTLang=en%2Dus; OTSEC670817=VHL8lUncM8RaRm8QbKdzI2Mjzh4-; CteMtRequestId=; AKSB=s=1409581037748&amp;r=https%3A//www.serviceprovider.com/portal.asp; OTSESSIONAABQRN=FA7C6FA5G873EG4D89G82E2GE8809C8075EF 
  Content-Type: application/x-www-form-urlencoded 
  Content-Length: 5989
  </code></pre>
  
  <p>Service Provider Response:</p>
  
  <pre><code>HTTP/?.? 302 Moved Temporarily 
  Cache-Control: private 
  Content-Type: text/html; charset=utf-8 
  Location: /Errors/500.100.asp?aspxerrorpath=/SAMLhandler.aspx 
  Server: Microsoft-IIS/7.5 
  webserver: usseat_cte95 
  Content-Length: 187 
  Date: Tue, 02 Sep 2014 14:14:16 GMT 
  Connection: keep-alive 
  Set-Cookie: ADRUM_BT=R%3a40%7cclientRequestGUID%3a6c526398-acce-4ae7-ae29-ee40e42648ab%7cbtId%3a553%7cbtERT%3a10; expires=Tue, 02-Sep-2014 14:14:46 GMT; path=/
  </code></pre>