Troubleshooting: SAML Consumer Rejects an Assertion With No Signature Found – SecureAuth Support

Version Affected: 9.x

Overview

After configuring the SecureAuth SAML Consumer on a realm's Workflow tab, when a 3rd-party IdP sends its SAML assertion, the SAML Consumer rejects it and displays a generic error to the user:

The SAML Consumer's generic rejection message: Please make sure there is a valid nameid or the user exists in the datastore.

Cause

The realm's debug log shows the actual reason for the rejection: VerifySAML - no signature found. The 3rd-party IdP that created the assertion did not sign it.

Resolution:

On the 3rd-party IdP that creates the assertion, make sure it's configured to sign the SAML assertion -- for example, a setting similar to:

A Sign SAML Assertion setting set to True.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.