Troubleshooting: Sign SAML Assertion vs Sign SAML Message – SecureAuth Support

Version Affected: All

Overview

Some Service Providers (SPs) require the SAML signature to be embedded within the <Assertion> element itself, rather than only at the outer SAML message level. This article explains SecureAuth's Sign SAML Assertion and Sign SAML Message realm settings, and how to produce a SAML response with a signed assertion.

Cause

By default, a SecureAuth realm signs the SAML message (the overall SAML response) but does not sign the SAML assertion contained within it. Some SPs will not accept a signed message if the signature is not also present inside the assertion itself.

Resolution

In the realm's SAML configuration, change the Sign SAML Assertion dropdown to True. Sign SAML Message can be left set to True at the same time; whether to sign both depends on whether the SP accepts receiving the signature twice — once in the assertion and once in the message.

Realm SAML settings showing the Sign SAML Assertion dropdown set to True and the Sign SAML Message dropdown set to False.

The screenshot above shows both settings, with Sign SAML Assertion set to True and Sign SAML Message set to False.

The two examples below show the same SAML assertion produced with each setting. With only Sign SAML Message enabled, the <Assertion> element contains no signature or certificate:

SAML assertion XML with Sign SAML Message enabled and Sign SAML Assertion disabled. The Assertion element contains Issuer, Subject, Conditions, AuthnStatement, and AttributeStatement, but no Signature or X509Certificate element.

With Sign SAML Assertion enabled, the <Assertion> element itself contains a <Signature> block with the signing certificate embedded inside it:

SAML assertion XML with Sign SAML Assertion enabled. A Signature element appears directly inside the Assertion element, containing SignedInfo, SignatureValue, and a KeyInfo block with the X509Certificate embedded, ahead of the Subject and AttributeStatement elements.

The X509Certificate is present within the assertion's own tags only when Sign SAML Assertion is enabled.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.