RocketChat/Rocket.Chat · error · Error

Invalid Signature

Error message

Invalid Signature

What it means

Error "Invalid Signature" thrown in RocketChat/Rocket.Chat.

Source

Thrown at apps/meteor/server/lib/saml/lib/parsers/Response.ts:285

		const checkEither = signatureType === 'Either';
		const checkResponse = signatureType === 'Response' || signatureType === 'All' || checkEither;
		const checkAssertion = signatureType === 'Assertion' || signatureType === 'All' || checkEither;
		let anyValidSignature = false;

		if (!this.serviceProviderOptions.cert) {
			if (checkResponse || checkAssertion) {
				SAMLUtils.log('Missing Signature validation params');
				throw new Error('Unable to validate signature');
			}
			return;
		}

		if (checkResponse) {
			SAMLUtils.log('Verify Document Signature');
			if (!this.validateResponseSignature(xml, this.serviceProviderOptions.cert, response)) {
				if (!checkEither) {
					SAMLUtils.log('Document Signature WRONG');
					throw new Error('Invalid Signature');
				}
			} else {
				anyValidSignature = true;
			}
			SAMLUtils.log('Document Signature OK');
		}

		if (checkAssertion) {
			SAMLUtils.log('Verify Assertion Signature');
			if (!this.validateAssertionSignature(assertionData.xml, this.serviceProviderOptions.cert, assertionData.assertion)) {
				if (!checkEither) {
					SAMLUtils.log('Assertion Signature WRONG');
					throw new Error('Invalid Assertion signature');
				}
			} else {
				anyValidSignature = true;
			}
			SAMLUtils.log('Assertion Signature OK');

View on GitHub (pinned to b2c16d5842)

Solutions

1. Update the IdP certificate in the SAML settings to the one currently used by the IdP to sign responses.

When it happens

Trigger: Thrown when the SAML Response signature fails cryptographic verification.

Common situations: See trigger scenarios.

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/4c16951f599e0e59. Report an issue: GitHub.