RocketChat/Rocket.Chat · error · Error

Unable to validate signature

Error message

Unable to validate signature

What it means

Error "Unable to validate signature" thrown in RocketChat/Rocket.Chat.

Source

Thrown at apps/meteor/server/lib/saml/lib/parsers/Response.ts:275

		return {
			assertion,
			xml: newXml || xml,
		};
	}

	private verifySignatures(response: Element, assertionData: ISAMLAssertion, xml: string): void {
		const signatureType = this.serviceProviderOptions.signatureValidationType;

		const checkEither = signatureType === 'Either';
		const checkResponse = signatureType === 'Response' || signatureType === 'All' || checkEither;
		const checkAssertion = signatureType === 'Assertion' || signatureType === 'All' || checkEither;
		let anyValidSignature = false;

		if (!this.serviceProviderOptions.cert) {
			if (checkResponse || checkAssertion) {
				SAMLUtils.log('Missing Signature validation params');
				throw new Error('Unable to validate signature');
			}
			return;
		}

		if (checkResponse) {
			SAMLUtils.log('Verify Document Signature');
			if (!this.validateResponseSignature(xml, this.serviceProviderOptions.cert, response)) {
				if (!checkEither) {
					SAMLUtils.log('Document Signature WRONG');
					throw new Error('Invalid Signature');
				}
			} else {
				anyValidSignature = true;
			}
			SAMLUtils.log('Document Signature OK');
		}

		if (checkAssertion) {

View on GitHub (pinned to b2c16d5842)

Solutions

1. Verify the IdP signing certificate configured on the SP matches the certificate used to sign the response, and that the signature algorithm is supported.

When it happens

Trigger: Thrown when a signature is present in the SAML response but its validity cannot be checked (e.g. missing cert).

Common situations: See trigger scenarios.

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/c36fa162598bd5db. Report an issue: GitHub.