Troubleshooting: SAML Consumer Rejects an Assertion With No Signature Found

Version Affected: 9.x
 
 

Overview

After configuring the SecureAuth SAML Consumer on a realm's Workflow tab, when a 3rd-party IdP sends its SAML assertion, the SAML Consumer rejects it and displays a generic error to the user:

Cause

The realm's debug log shows the actual reason for the rejection: VerifySAML - no signature found. The 3rd-party IdP that created the assertion did not sign it.

Resolution:

On the 3rd-party IdP that creates the assertion, make sure it's configured to sign the SAML assertion -- for example, a setting similar to:

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.