RocketChat/Rocket.Chat · error · Error

Too many SAML assertions

Error message

Too many SAML assertions

What it means

Error "Too many SAML assertions" thrown in RocketChat/Rocket.Chat.

Source

Thrown at apps/meteor/server/lib/saml/lib/parsers/Response.ts:223

		}

		SAMLUtils.log('Verify status');
		const statusValidateObj = SAMLUtils.validateStatus(doc);
		if (!statusValidateObj.success) {
			return callback(new Error(`Status is: ${statusValidateObj.statusCode}`), null, false);
		}
		SAMLUtils.log('Status ok');

		// @ToDo: Check if this situation is still used
		return callback(null, null, true);
	}

	private getAssertion(response: Element, xml: string): ISAMLAssertion {
		const allAssertions = response.getElementsByTagNameNS('urn:oasis:names:tc:SAML:2.0:assertion', 'Assertion');
		const allEncrypedAssertions = response.getElementsByTagNameNS('urn:oasis:names:tc:SAML:2.0:assertion', 'EncryptedAssertion');

		if (allAssertions.length + allEncrypedAssertions.length > 1) {
			throw new Error('Too many SAML assertions');
		}

		let assertion: Element = allAssertions[0];
		const encAssertion = allEncrypedAssertions[0];
		let newXml = null;

		if (typeof encAssertion !== 'undefined') {
			// disallowDecryptionWithInsecureAlgorithm defaults to true in xml-encryption v4, but AES-CBC/3DES
			// are still widely used by SAML IdPs in practice, so we keep the pre-v4 behaviour here.
			const options = { key: this.serviceProviderOptions.privateKey, disallowDecryptionWithInsecureAlgorithm: false };
			const encData = encAssertion.getElementsByTagNameNS('*', 'EncryptedData')[0];
			xmlenc.decrypt(encData, options, (err, result) => {
				if (err) {
					SAMLUtils.error(err);
				}

				const document = new xmldom.DOMParser().parseFromString(result, 'text/xml');
				if (!document) {

View on GitHub (pinned to b2c16d5842)

Solutions

1. Check the IdP configuration so it returns a single assertion per response; inspect the raw SAML response for duplicates.

When it happens

Trigger: Thrown when a SAML Response contains more than one Assertion node, which is not supported.

Common situations: See trigger scenarios.

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/201af6d5af17733f. Report an issue: GitHub.