Troubleshooting: Sign SAML Assertion vs Sign SAML Message

Version Affected: All
 
 

Overview

Some Service Providers (SPs) require the SAML signature to be embedded within the <Assertion> element itself, rather than only at the outer SAML message level. This article explains SecureAuth's Sign SAML Assertion and Sign SAML Message realm settings, and how to produce a SAML response with a signed assertion.
 
 

Cause

By default, a SecureAuth realm signs the SAML message (the overall SAML response) but does not sign the SAML assertion contained within it. Some SPs will not accept a signed message if the signature is not also present inside the assertion itself.
 
 

Resolution

In the realm's SAML configuration, change the Sign SAML Assertion dropdown to True. Sign SAML Message can be left set to True at the same time; whether to sign both depends on whether the SP accepts receiving the signature twice — once in the assertion and once in the message.

The screenshot above shows both settings, with Sign SAML Assertion set to True and Sign SAML Message set to False.

The two examples below show the same SAML assertion produced with each setting. With only Sign SAML Message enabled, the <Assertion> element contains no signature or certificate:

With Sign SAML Assertion enabled, the <Assertion> element itself contains a <Signature> block with the signing certificate embedded inside it:

The X509Certificate is present within the assertion's own tags only when Sign SAML Assertion is enabled.
 
 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.