sailpoint.tools.GeneralException: Signature cryptographic validation not successful

Implement & Extend
, ,
1

Hi

We are trying to Azure SAML integration, when we try to access the /iiq page, it redirects to azure and then ends up in the login.jsf page.I have logged all sso and I can see the below error. But the certficate doesn’t seem to have any issue. We downloaded from Azure in base64 format and uploaded.In the logs, it even shows the correct certificate details.

Exiting getSAMLX509Certificate = [
[
Version: V3
Subject: CN=accounts.accesscontrol.windows.net
Signature Algorithm: SHA256withRSA,

2022-03-29 14:21:42,792â??â??â??â??â??â??â??â??â??â??â?? TRACE https-jsse-nio-443-exec-34 â.â.â.SAMLSSOAuthenticator$DefaultSignatureValidatorâ??â??â??â??â??â??â??â??â??â??â??:126 - Exiting <init> = null
2022-03-29 14:21:42,792â??â??â??â??â??â??â??â??â??â??â?? TRACE https-jsse-nio-443-exec-34 â.â.â.SAMLSSOAuthenticatorâ??â??â??â??â??â??â??â??â??â??â??:150 - Exiting getXMLSignatureValidator = sailpoint.web.sso.SAMLSSOAuthenticator$DefaultSignatureValidator@4be75011
2022-03-29 14:21:42,792â??â??â??â??â??â??â??â??â??â??â?? TRACE https-jsse-nio-443-exec-34 â.â.â.SAMLSSOAuthenticator$DefaultSignatureValidatorâ??â??â??â??â??â??â??â??â??â??â??:138 - Entering validate(signature = null)
2022-03-29 14:21:42,793â??â??â??â??â??â??â??â??â??â??â?? TRACE https-jsse-nio-443-exec-34 â.â.â.SAMLSSOAuthenticator$DefaultSignatureValidatorâ??â??â??â??â??â??â??â??â??â??â??:150 - Exiting validate = false
2022-03-29 14:21:42,793â??â??â??â??â??â??â??â??â??â??â?? TRACE https-jsse-nio-443-exec-34 â.â.â.SAMLSSOAuthenticatorâ??â??â??â??â??â??â??â??â??â??â??:138 - Entering getXMLSignatureValidator()
2022-03-29 14:21:42,793â??â??â??â??â??â??â??â??â??â??â?? TRACE https-jsse-nio-443-exec-34 â.â.â.SAMLSSOAuthenticatorâ??â??â??â??â??â??â??â??â??â??â??:150 - Exiting getXMLSignatureValidator = sailpoint.web.sso.SAMLSSOAuthenticator$DefaultSignatureValidator@4be75011
2022-03-29 14:21:42,793â??â??â??â??â??â??â??â??â??â??â?? TRACE https-jsse-nio-443-exec-34 â.â.â.SAMLSSOAuthenticator$DefaultSignatureValidatorâ??â??â??â??â??â??â??â??â??â??â??:138 - Entering validate(signature = org.opensaml.xmlsec.signature.impl.SignatureImpl@5a2a4aa)
2022-03-29 14:21:42,794â??â??â??â??â??â??â??â??â??â??â?? WARN https-jsse-nio-443-exec-34 â.â.â.â.â.XMLSignatureâ??â??â??â??â??â??â??â??â??â??â??:755 - Signature verification failed.
2022-03-29 14:21:42,795â??â??â??â??â??â??â??â??â??â??â?? TRACE https-jsse-nio-443-exec-34 â.â.â.SAMLSSOAuthenticator$DefaultSignatureValidatorâ??â??â??â??â??â??â??â??â??â??â??:156 - Throwing validate - sailpoint.tools.GeneralException: Signature cryptographic validation not successful
2022-03-29 14:21:42,795â??â??â??â??â??â??â??â??â??â??â?? ERROR https-jsse-nio-443-exec-34 â.â.â.SAMLSSOAuthenticatorâ??â??â??â??â??â??â??â??â??â??â??:344 - An error occurred verifying the SAML assertion
sailpoint.tools.GeneralException: Signature cryptographic validation not successful

But ends up with above error. What could be the issue here?

2

Anyone has seen this error with saml?

3

Hi,

Same situation in my case. Did you find a solution for your issue?

Thanks,

Jeremie

4

Hi,

facing Same issues,

Caused by: org.opensaml.xmlsec.signature.support.SignatureException: Signature cryptographic validation not successful
at org.opensaml.xmlsec.signature.support.impl.provider.ApacheSantuarioSignatureValidationProviderImpl.validate(ApacheSantuarioSignatureValidationProviderImpl.java:79) ~[opensaml-xmlsec-impl-3.4.5.jar:?]
at org.opensaml.xmlsec.signature.support.SignatureValidator.validate(SignatureValidator.java:54) ~[opensaml-xmlsec-api-3.4.5.jar:?]
at sailpoint.web.sso.SAMLSSOAuthenticator$DefaultSignatureValidator.validate(SAMLSSOAuthenticator.java:140).

Any solution?

Regards,

Dharani

5

@Div_sec   @Bhavadharani   @jeremiecollomb_hrpath  
Hi All, were you able to find a solution for this issue?

Thanks,
Antra

6

@Div_sec @Bhavadharani @jeremiecollomb_hrpath  @antra_saxena

Same issue, what did you guys change to fix?

7

Hi, @Div_sec

Same situation here . Did you find a solution for your issue?

Thanks

8

@RobSCVW This could be due to the mismatch between what Azure AD (Entra ID) is signing and what SailPoint IdentityIQ is configured to expect. When the SignatureValidator returns false, the cryptographic hash calculated from the incoming XML does not match the signature provided. You might want to check with your Azure team to change the Azure Signing Option Settings.

Note: Found a fix? Mark it as a solution! Want to say thanks? Give Kudos to anyone who helped you understand or solve the problem. Thanks..!!!