Signature validation failing even though the request isn't signed
kwessel at illinois.edu
Wed Dec 8 16:05:38 UTC 2021
I've been chasing my tail trying to track this down. Last week, authentication with a federated SP stopped working. The vendor claims to have made no changes on their side, and our IdP hasn't changed. The IdP log is reporting:
[org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:275] - Message Handler: Simple signature validation (with no request-derived credentials) failed
[org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:214] - Message Handler: Validation of request simple signature failed for context issuer: https://riskonnectbtaauil.my.salesforce.com
It's true that there are no request-derived credentials. In fact, the authn request isn't even signed:
That's what I'm getting from the SAML tracer plugin in my browser just before the error.
The IdP is configured with default behavior for request signatures: it shouldn't be requiring it, and the metadata for this SP has nothing about signAuthnRequests. There was a signing certificate in their metadata which I removed for good measure, but the error remains.
I'm used to seeing this error when there's a cert mismatch between metadata and the cert being used to sign the request. But since there's no signing cert in metadata and no cert being used to sign the request, that's obviously not the issue.
More information about the users