<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi,<div class=""><br class=""></div><div class="">I’m using IDP 3.2.1. There is one SP that reports that the signature the IDP is sending in the SAML response is invalid. The cert in the response is correct. I checked the response with the validation tool at <<a href="https://www.samltool.com/validate_response.php" class="">https://www.samltool.com/validate_response.php</a>>, and get the error:</div><div class=""><br class=""></div><div class=""><h3 style="box-sizing: inherit; font-family: 'Gotham SSm 4r', Calibri, Candara, 'Helvetica Neue', Arial, Helvetica, sans-serif; font-weight: 500; line-height: 1.5; color: rgb(255, 66, 55); margin-top: 20px; margin-bottom: 10px; text-transform: uppercase; letter-spacing: 0.15px; font-size: 16px; background-color: rgba(255, 66, 55, 0.0980392); padding-left: 0px !important; padding-right: 0px !important;" class=""><label style="box-sizing: inherit; font-weight: 700; display: inline-block; margin-bottom: 5px; font-size: 12px; width: 1066px;" class="">THE SAML RESPONSE IS INVALID.</label></h3><pre class=" language-php" style="box-sizing: inherit; word-wrap: break-word; overflow: auto; font-size: 13px; line-height: 19.5px; color: rgb(55, 59, 65); font-family: Menlo, Monaco, Consolas, monospace; padding: 1em; margin-top: 0.5em; margin-bottom: 0.5em; word-break: normal; background-color: rgb(250, 250, 250); border: none; border-top-left-radius: 4px; border-top-right-radius: 4px; border-bottom-right-radius: 4px; border-bottom-left-radius: 4px; direction: ltr; height: auto; tab-size: 4; -webkit-hyphens: none; -webkit-font-smoothing: antialiased;"><code class=" language-php" style="box-sizing: inherit; padding: 0px; font-family: Menlo, Monaco, Consolas, monospace; background-color: transparent; border-top-left-radius: 0px; border-top-right-radius: 0px; border-bottom-right-radius: 0px; border-bottom-left-radius: 0px; direction: ltr; word-spacing: normal; word-break: normal; height: auto; line-height: 19.5px; tab-size: 4; -webkit-hyphens: none; -webkit-font-smoothing: antialiased;">Reference validation failed</code></pre><div class=""><br class=""></div></div><div class="">What else should I examine or change in my configuration?</div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">Jeff</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">The response is included</div><div class="">———————————</div><div class=""><br class=""></div><div class=""><div class=""><saml2p:Response</div><div class=""> Destination="<a href="https://sp-here/wfc/logonESS_SSO" class="">https://sp-here/wfc/logonESS_SSO</a>"</div><div class=""> ID="_05ba5ba9448be7de75cdebc878bbd97d"</div><div class=""> IssueInstant="2017-01-04T21:26:03.850Z" Version="2.0"</div><div class=""> xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema" class="">http://www.w3.org/2001/XMLSchema</a>"></div><div class=""> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion”>idp-here</saml2:Issuer></div><div class=""> <ds:Signature</div><div class=""> xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig" class="">http://www.w3.org/2000/09/xmldsig</a>#"></div><div class=""><ds:SignedInfo></div><div class=""><ds:CanonicalizationMethod</div><div class=""> Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n" class="">http://www.w3.org/2001/10/xml-exc-c14n</a>#"/></div><div class=""><ds:SignatureMethod</div><div class=""> Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" class="">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a>"/></div><div class=""><ds:Reference</div><div class=""> URI="#_05ba5ba9448be7de75cdebc878bbd97d"></div><div class=""><ds:Transforms></div><div class=""><ds:Transform</div><div class=""> Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature" class="">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>"/></div><div class=""><ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n" class="">http://www.w3.org/2001/10/xml-exc-c14n</a>#"></div><div class=""> <ec:InclusiveNamespaces PrefixList="xsd" xmlns:ec="<a href="http://www.w3.org/2001/10/xml-exc-c14n" class="">http://www.w3.org/2001/10/xml-exc-c14n</a>#"/></div><div class=""> </ds:Transform></div><div class=""></ds:Transforms></div><div class=""><ds:DigestMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#sha256" class="">http://www.w3.org/2001/04/xmlenc#sha256</a>"/></div><div class=""><ds:DigestValue>JxUltIs20c/mhD6UZcpN2U4Df+BtQuNUqZl4p5cA5dA=</ds:DigestValue></div><div class=""></ds:Reference></div><div class=""></ds:SignedInfo></div><div class=""><ds:SignatureValue></div><div class="">WP8Iaf0xOFzj0Gk+QO+rrAeYPrjn1DFjzagl8rS15ykDUCUA4C0H5D1DVcj9BL43Z+KT+2WPZW5Y</div><div class="">scp0EZDg+rXpU/6h3qL6alvbUljCnOojDa2NtX5diShQHb8ClPhD0vDi5VBA8KeZ5JzgPqKSWL64</div><div class="">FJYeDhQLBWXDi4qSyCC4NdvZ6WvSUV7CtXOAXe791Uzp+hQ/pM9FKlfm01WIH9Cd/6TPwcjrtkXU</div><div class="">QhXoTMvPQVPMBnHVw1hLLVh2lxUcrHe5D3OvEVwY3tfoSBuz5QxXxxKTI7XJFCQ5VreM7BjLGD/f</div><div class="">6P3VakU4RrrbJTpwx6u3hS7v4IEOu+qI6HGu+Q==</div><div class=""></ds:SignatureValue></div><div class=""><ds:KeyInfo></div><div class=""> <ds:X509Data></div><div class=""> <ds:X509Certificate></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>[……..]</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span></ds:X509Certificate></div><div class=""> </ds:X509Data></div><div class=""> </ds:KeyInfo></div><div class=""> </ds:Signature></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> <saml2p:Status></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> </saml2p:Status></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> <saml2:Assertion ID="_02727147fca88cb6b03bc1fe34ef25f4"</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> IssueInstant="2017-01-04T21:26:03.850Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> <saml2:Issuer>idp-here</saml2:Issuer></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> <saml2:Subject></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> <saml2:SubjectConfirmationData Address="10.136.1.241"</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> NotOnOrAfter="2017-01-04T21:31:03.862Z" Recipient=“sp-here"/></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> </saml2:SubjectConfirmation></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> </saml2:Subject></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> <saml2:Conditions NotBefore="2017-01-04T21:26:03.850Z" NotOnOrAfter="2017-01-04T21:31:03.850Z"></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> <saml2:AudienceRestriction></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> <saml2:Audience>entity-id-here</saml2:Audience></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> </saml2:AudienceRestriction></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> </saml2:Conditions></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> <saml2:AuthnStatement AuthnInstant="2017-01-04T21:26:03.621Z" SessionIndex="_79ac04e21ca4c9ae04aca42e3629dc94"></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> <saml2:SubjectLocality Address="10.136.1.241"/></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> <saml2:AuthnContext></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> </saml2:AuthnContext></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> </saml2:AuthnStatement></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> <saml2:AttributeStatement></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> <saml2:Attribute</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> FriendlyName=“attribute-name"</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> Name="urn:oid:1.3.6.1.4.1.4995.2.200.10.1.5.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> <saml2:AttributeValue</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" class="">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xsd:string”>some-value</saml2:AttributeValue></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> </saml2:Attribute></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> </saml2:AttributeStatement></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span> </saml2:Assertion></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span></saml2p:Response></div></div></body></html>