RocketChat/Rocket.Chat · error · Error

Invalid Assertion signature

Error message

Invalid Assertion signature

What it means

Error "Invalid Assertion signature" thrown in RocketChat/Rocket.Chat.

Source

Thrown at apps/meteor/server/lib/saml/lib/parsers/Response.ts:298

		if (checkResponse) {
			SAMLUtils.log('Verify Document Signature');
			if (!this.validateResponseSignature(xml, this.serviceProviderOptions.cert, response)) {
				if (!checkEither) {
					SAMLUtils.log('Document Signature WRONG');
					throw new Error('Invalid Signature');
				}
			} else {
				anyValidSignature = true;
			}
			SAMLUtils.log('Document Signature OK');
		}

		if (checkAssertion) {
			SAMLUtils.log('Verify Assertion Signature');
			if (!this.validateAssertionSignature(assertionData.xml, this.serviceProviderOptions.cert, assertionData.assertion)) {
				if (!checkEither) {
					SAMLUtils.log('Assertion Signature WRONG');
					throw new Error('Invalid Assertion signature');
				}
			} else {
				anyValidSignature = true;
			}
			SAMLUtils.log('Assertion Signature OK');
		}

		if (checkEither && !anyValidSignature) {
			SAMLUtils.log('No Valid Signature');
			throw new Error('No valid SAML Signature found');
		}
	}

	private validateResponseSignature(xml: string, cert: string, response: Element): boolean {
		return this.validateSignatureChildren(xml, cert, response);
	}

	private validateAssertionSignature(xml: string, cert: string, assertion: Element): boolean {

View on GitHub (pinned to b2c16d5842)

Solutions

1. Update the IdP certificate in the SAML settings, or configure the IdP to sign the assertion with the expected certificate.

When it happens

Trigger: Thrown when the SAML Assertion signature fails cryptographic verification.

Common situations: See trigger scenarios.

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/4553856f062cf086. Report an issue: GitHub.