Error incorrect signature on SAML Assert

I am getting an “incorrect signature” error on SAML POST response hitting the assert endpoint. I traced it down in samlify source to this code in entity.ts:

// verify the signatures (for both assertion/message)
        if (!libsaml.verifySignature(res, {
          cert: opts.from.entityMeta,
          signatureAlgorithm: opts.from.entitySetting.requestSignatureAlgorithm,
        })) {
          throw new Error('incorrect signature');
        }

But when I check my response using this service: https://www.samltool.com/validate_response.php everything seems to validate fine. How can I debug this further?

[hammadzz]

@tngan I traced down the issue to being a mismatch on the digest value. The calculated digest of the canonized assertion does not match the value in the signature. This part of the code is in the xml-crypto library.

In the verifySignature method when using xml-crypto and calling checkSignature you can get the validationErrors. This helped me figure out the issue is with the digest value mismatch.

var res = sig.checkSignature(xml)
if (!res) console.log(sig.validationErrors)

Still trying to figure out if it is an issue with how the assertion is canonized.

[tngan]

@hammadzz

Another possibility is the order of signature, in case if you have encryption in saml assertion as well, default is sign-then-encrypt, but most likely it would be encrypt-then-sign.

const idp = saml.identityProvider({
  messageSigningOrders: 'encrypt-then-sign'
});

Any tips on what can be done to debug this further. Is samltool.com wrong or the library has a bug?

samltool.com is good enough. I cannot tell whether samlify has bug or configuration mistake at this stage until I know the exact problem, would you like to set up a sample repository then we can take a look deeply. Please send an email to [e-mail] if something you don’t want to expose here.