"Signature Did Not Verify" Error on SAML2 AuthnRequest When "Require Signed Authentication Requests" Is Set to No
Article ID: 265963
Updated On:
Products
Issue/Introduction
In a SAML2 federation partnership configured as an Identity Provider (IdP), the option "Require Signed Authentication Requests" is set to No.
However, when a SAMLRequest is received, the Policy Server reports a signature verification failure and does not generate a SAMLResponse.
[01/01/2023][01:23:45][01:23:45.678][AssertionHandlerSAML20.java][preProcess] ... Start to validate the SAML2.0 Authn request.[01/01/2023][01:23:45][01:23:45.678][AuthnRequestProtocol.java][validateRequest] ... Validating the Request...All the properties:[01/01/2023][01:23:45][01:23:45.678][SignatureProcessor.java][verifyFromHTTP] ... Primary certificate to verify signature: alias: "<cert_alias>"[01/01/2023][01:23:45][01:23:45.679][SignatureProcessor.java][verifyFromHTTP] ... Signature verification with primary certificate failed with message: Caught an Exception while verifying revocation status of the certificate. Multiple certificates exist for issuer CN=<user> and serial number <serialnumber>.[01/01/2023][01:23:45][01:23:45.679][SignatureProcessor.java][verifyFromHTTP] ... Checking for secondary certificate[01/01/2023][01:23:45][01:23:45.679][SignatureProcessor.java][verifyFromHTTP] ... Secondary certificate is not configured.[01/01/2023][01:23:45][01:23:45.679][AuthnRequestProtocol.java][verifySignatureOnRequest] ... Signature did not verify.[01/01/2023][01:23:45][01:23:45.679][AssertionGenerator.java][invoke] ... AssertionHandler preProcess() failed. Leaving AssertionGenerator.
Environment
- Policy Server 12.8.x
- Policy Server 12.9
Cause
The "Require Signed Authentication Requests: No" setting means only that a signed SAMLRequest is not required — unsigned requests will be accepted and processed (1).
Despite this setting, if a signed authentication request is received, the Policy Server will still attempt to verify the signature. Verification will fail if the correct Service Provider (SP) certificate is not configured on the IdP side, or if no certificate is configured at all.
As per the OASIS standard, when the SP sends a signed SLO <LogoutRequest>, the IdP is expected to verify the signature to confirm the request originated from a known and trusted Service Provider — regardless of whether signing is strictly required by configuration (2).
If the certificate is missing or misconfigured on the IdP side, that verification will fail.
Resolution
There are two ways to resolve this issue:
Option 1: Configure the Service Provider (SP) to not sign the AuthnRequest.
Option 2: Configure the Identity Provider (IdP) federation partnership with the correct SP certificate so that signature verification succeeds.
Additional Information
Feedback
