RocketChat/Rocket.Chat · error · Error

No valid SAML Signature found

Error message

No valid SAML Signature found

What it means

Error "No valid SAML Signature found" thrown in RocketChat/Rocket.Chat.

Source

Thrown at apps/meteor/server/lib/saml/lib/parsers/Response.ts:308

			SAMLUtils.log('Document Signature OK');
		}

		if (checkAssertion) {
			SAMLUtils.log('Verify Assertion Signature');
			if (!this.validateAssertionSignature(assertionData.xml, this.serviceProviderOptions.cert, assertionData.assertion)) {
				if (!checkEither) {
					SAMLUtils.log('Assertion Signature WRONG');
					throw new Error('Invalid Assertion signature');
				}
			} else {
				anyValidSignature = true;
			}
			SAMLUtils.log('Assertion Signature OK');
		}

		if (checkEither && !anyValidSignature) {
			SAMLUtils.log('No Valid Signature');
			throw new Error('No valid SAML Signature found');
		}
	}

	private validateResponseSignature(xml: string, cert: string, response: Element): boolean {
		return this.validateSignatureChildren(xml, cert, response);
	}

	private validateAssertionSignature(xml: string, cert: string, assertion: Element): boolean {
		return this.validateSignatureChildren(xml, cert, assertion);
	}

	private validateSignatureChildren(xml: string, cert: string, parent: Element): boolean {
		const signatures = parent.getElementsByTagNameNS('http://www.w3.org/2000/09/xmldsig#', 'Signature');
		let signature = null;

		for (let i = 0; i < signatures.length; i++) {
			const sign = signatures[i];
			if (sign.parentNode !== parent) {

View on GitHub (pinned to b2c16d5842)

Solutions

1. Configure the IdP to sign either the response or the assertion; unsigned responses are rejected when signature validation is required.

When it happens

Trigger: Thrown when neither the SAML Response nor the Assertion carries a valid signature.

Common situations: See trigger scenarios.

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/0365426782c21cc4. Report an issue: GitHub.