SAML "Signature validation failed" in CI SSO tests

By Daniel Zoghalchali·Latchkey

The SAML service provider rejected the assertion because the XML signature did not validate against the configured IdP certificate. Usually the IdP signing certificate in the SP config is stale or wrong.

What this error means

A SAML login test fails with "Signature validation failed. SAML Response rejected" (passport-saml / node-saml). The IdP cert in the SP config does not match the cert that signed the response.

Error: Invalid signature
    at SAML.validatePostResponse (/app/node_modules/@node-saml/node-saml/lib/saml.js:...)
  message: 'Invalid document signature'

Common causes

Stale or wrong IdP signing certificate

The certificate configured on the SP does not match the one the IdP used to sign, so the signature check fails.

Response altered in transit or wrong element signed

A modified assertion, or signing the wrong element than the SP validates, causes signature failure.

How to fix it

Configure the current IdP certificate

1. Export the IdP signing certificate from its metadata.
2. Set it as the SP idpCert / cert option.
3. Re-run the SSO test so the signature validates.

const saml = new SAML({
  idpCert: fs.readFileSync('idp-signing.pem', 'utf8'),
  issuer: 'ci-sp'
});

Load the IdP cert from metadata

Parse the IdP metadata XML in setup to get the exact signing certificate, avoiding drift from a hardcoded value.

How to prevent it

• Load the IdP signing cert from metadata rather than hardcoding.
• Update the SP config when the IdP rotates its certificate.
• Match the signed element to what the SP validates.

Frequently asked questions

Related guides

References

• GitHub Actions documentation