DocumentationExperience Cloud KCS

AEM: SSO authentication fails after TrustStore recreation due to missing permissions

Last update: July 17, 2026

Resolve SSO authentication failures in Adobe Experience Manager after TrustStore recreation and SAML certificate updates.

Description description

Environment

Adobe Experience Manager (AEM) (all versions)

Issue/Symptoms

After recreating the TrustStore and updating the SSO certificate and alias in the Adobe Granite SAML 2.0 Authentication Handler OSGi configuration, SSO authentication fails. The following error appears in the logs:

*ERROR* [ qtp75834943-16122]  com.adobe.granite.auth.saml.SamlAuthenticationHandler Could not access TrustStore to get the IdP certificate.
  • SSO login attempts are unsuccessful.
  • The TrustStore and certificate alias have been updated, but authentication still fails.
  • The issue is reproducible on the affected environment after TrustStore recreation.

Resolution resolution

Try the following steps to solve the issue:

  1. Confirm that the updated TrustStore exists at the expected location on the affected AEM instance, and ensure that the TrustStore content has been updated after the certificate is re-imported.
  2. In the Adobe Granite SAML 2.0 Authentication Handler OSGi configuration, ensure that the configured IdP certificate alias exactly matches the alias present in the TrustStore.
  3. Review the access controls for the TrustStore location and ensure that the service responsible for reading the TrustStore has read access to the current TrustStore location.
  4. If the TrustStore was recreated, verify that permissions do not still point to an older location, and update them so they reference the current TrustStore location.
  5. Compare the access controls with a working environment or a default setup for reference.
  6. After updating permissions, attempt SSO login again to confirm that the issue is resolved.

Cause

After the TrustStore was recreated, the required read permission was missing on the new TrustStore location. This prevented AEM from accessing the IdP certificate at runtime, resulting in SSO authentication failure.

recommendation-more-help
experience-cloud-kcs-help-kbarticles