SAML Signature mismatch error

Products

• Symantec Products

Issue/Introduction

F5 BIG-IP SAML configured with VIP and is getting a Digest of signature mismatch error returned.


 

SAML Agent: /Common/uri_check_act_saml_auth_ag failed to process signed assertion, error: Digest of signature mismatch

Cause

BIG-IP supports only exclusive canonicalization for SAML messages.  Exclusive Canonicalization ensures that signatures created over SAML messages embedded in an XML context can be verified independent of that context. 

F5 is rejecting our response due to the Canonicalization method being used in VIP.  We recommend and accept the assertion in the supported format but send a response using a different canonicalization.

 

Resolution

This issue is resolved in VIP 9.8