SAML authentication fails after upgrading Web Help Desk to 2026.2.1 in FIPS mode

After upgrading Web Help Desk to 2026.2.1, users might be unable to sign in through SAML. The login page can remain in a waiting state, or the WHD logs can contain errors such as:

• Invalid issuer during SAML login

• java.security.NoSuchAlgorithmException: Error constructing implementation

• Errors related to the BCFKS truststore or SSLContextImpl$DefaultSSLContext

• This issue can occur when the Java runtime does not use the BCFKS truststore configured for the WHD FIPS environment.

  • Web Help Desk 2026.2.1

  • FIPS mode enabled

  • SAML authentication configured

Add the following Java system properties to the Java startup arguments used by the Web Help Desk service:

-Djavax.net.ssl.trustStoreType=BCFKS
-Djavax.net.ssl.trustStore="%WHD_HOME%\conf\keyStore.bcfks"
-Djavax.net.ssl.trustStorePassword=<BCFKS_keystore_password>

Replace <BCFKS_keystore_password> with the password for the BCFKS keystore in the WHD installation. Do not publish or share the password.

Procedure

1. Stop the Web Help Desk service.

2. Add the three Java system properties to the service's Java startup arguments.

3. Confirm that %WHD_HOME% resolves to the Web Help Desk installation directory.

4. Confirm that %WHD_HOME%\conf\keyStore.bcfks exists and that the Web Help Desk service account can read the file.

5. Start the Web Help Desk service.

6. Test SAML login with a user account.

7. Review the WHD logs to confirm that the BCFKS truststore and SSL initialization errors no longer occur.

If the issue continues, verify the keystore path, keystore password, file permissions, and SAML identity provider configuration. Do not disable TLS validation or replace the BCFKS truststore with an unprotected keystore as a workaround.