Getting 'Invalid Signature' error on SAML Response. XML digests do not match

We’re having some issues getting passport-saml setup with an Okta IDP. We are getting a response back from our IDP, but the validation is failing. Our IDP made sure that the signature and digests are done with SHA1. Debugging into the code, (all the way into the XMLCrypto), I’m finding that it is failing when the digests don’t match. If we comment out the assertion validation, we are getting all the expected data so I’m pretty sure that SAML response is formatted properly.

I added in a console.log to get the canonXML that is being hashed for the digest, and the output is this:

<ns2:Assertion xmlns:ns2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_73bfe3a75de08316ce83cb05534a91aa2837" IssueInstant="2015-03-16T21:50:22Z" Version="2.0">&#xD;
        <ns2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">REDACTED</ns2:Issuer>&#xD;
        <ns2:Subject>&#xD;
            <ns2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">REDACTED</ns2:NameID>&#xD;
            <ns2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">&#xD;
                <ns2:SubjectConfirmationData NotOnOrAfter="2015-03-16T21:51:51Z" Recipient="https://REDACTED"></ns2:SubjectConfirmationData>&#xD;
            </ns2:SubjectConfirmation>&#xD;
        </ns2:Subject>&#xD;
        <ns2:Conditions NotBefore="2015-03-16T21:49:51Z" NotOnOrAfter="2015-03-16T21:51:51Z">&#xD;
            <ns2:AudienceRestriction>&#xD;
                <ns2:Audience>REDACTED</ns2:Audience>&#xD;
            </ns2:AudienceRestriction>&#xD;
        </ns2:Conditions>&#xD;
        <ns2:AuthnStatement AuthnInstant="2015-03-16T21:22:30Z" SessionIndex="rqRyLqemlvvu9A3OE9la6I1Z8iY=RgRbeg==" SessionNotOnOrAfter="2015-03-16T21:51:51Z">&#xD;
            <ns2:AuthnContext>&#xD;
                <ns2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</ns2:AuthnContextClassRef>&#xD;
            </ns2:AuthnContext>&#xD;
        </ns2:AuthnStatement>&#xD;
        <ns2:AttributeStatement>&#xD;
            <ns2:Attribute Name="FirstName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">&#xD;
                <ns2:AttributeValue>REDACTED</ns2:AttributeValue>&#xD;
            </ns2:Attribute>&#xD;
            <ns2:Attribute Name="LastName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">&#xD;
                <ns2:AttributeValue>REDACTED</ns2:AttributeValue>&#xD;
            </ns2:Attribute>&#xD;
        </ns2:AttributeStatement>&#xD;
    </ns2:Assertion>

One thing that concerns is me the ’ ’ line endings, yet in the console we are also getting the line feeds and other whitespace. I know next to nothing about XML canonicalization, but I’m wondering if the CRLFs in the SAML Response are not being properly transformed into the Canon XML for hashing.

Another thing we’re wondering is if our configuration on the provider side has anything to do with digest and signature (aside from the cert). For example, all the code examples we’ve seen have ‘passport-saml’ as the issuer, but we used our own issuer that we created basically at random and gave to our IDP. We assumed that was just a placeholder for our own issuer.

Unfortunately, my team isn’t in charge of the IDP so we don’t really have much control over it, and we’re also the first in our org to try to use Node.js with SAML, so we’re treading new ground with our SAML team to get this working.

[markstos]

@archa347 How did your follow-up with xml-crypto go? That project doesn’t keep a Changelog, so it’s hard to tell if there have been an related fixes to xml-crypto. If so, it could be a good idea to version-bump the dependency that passport-saml requires.

[markstos]

Start by checking out the passport SAML source code.

On Tue, Jan 2, 2018, 1:55 AM akash-goel [e-mail] wrote:

I am working on test cases and getting Signature validation failed error on validating the SAML response . Please help me in identifying which parameters are responsible for Signature Creation and Validation

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/bergie/passport-saml/issues/82#issuecomment-354711045, or mute the thread https://github.com/notifications/unsubscribe-auth/AABk5TTq9TLdwH2X5HsWusZp1CNgiIswks5tGdLIgaJpZM4DvpCe .