apereo/cas · warning

No assertion or its configuration was provided to validate…

Error message

No assertion or its configuration was provided to validate signatures

What it means

WsFederationHelper.validateSignature validates the signature of a SAML assertion paired with its WsFederationConfiguration. If the Pair itself is null it logs this warning and returns false, since there is nothing to validate. Callers treat false as failed credential validation.

Solutions

1. Fix the upstream step that produced the null pair — validate the wresult response and log its failure before calling validateSignature.
2. Check that the IdP is actually returning a signed assertion (inspect the raw wresult).
3. Guard the call site: only invoke validateSignature when assertion extraction succeeded.
4. If this is a test, assert extraction succeeds before exercising validation.

Example fix

// before
boolean ok = helper.validateSignature(pair); // pair may be null
// after
if (pair == null || pair.getKey() == null) {
    throw new IllegalStateException("Assertion extraction failed");
}
boolean ok = helper.validateSignature(pair);

if (resultPair == null) {
    LOGGER.error("Assertion extraction failed before signature validation");
    return;
}

boolean isValidateInput(Pair<Assertion, WsFederationConfiguration> p) {
    return p != null && p.getKey() != null && p.getValue() != null;
}

When it happens

Trigger: A previous parsing step (e.g. extracting/assertion building from the wresult) returned null and that null pair was passed directly into validateSignature.

Common situations: Broken wresult/wa form posts from the IdP; assertion extraction failed earlier and error was not surfaced; unit tests passing null; IdP returned an error response page instead of a token.

Related errors

• No signature or configuration was provided to validate…
• No signature is attached to the assertion to validate
• Request is not signed but should be
• Proof JWT signature validation failed
• JWK type is not supported

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/ef8ffe2ee6a4f78a. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-wsfederation/src/main/java/org/apereo/cas/support/wsfederation/WsFederationHelper.java:252

    /**
     * Gets assertion from security token.
     *
     * @param reqToken the req token
     * @return the assertion from security token
     */
    public XMLObject getAssertionFromSecurityToken(final RequestedSecurityToken reqToken) {
        return reqToken.getSecurityTokens().getFirst();
    }

    /**
     * validateSignature checks to see if the signature on an assertion is valid.
     *
     * @param resultPair a provided assertion
     * @return true if the assertion's signature is valid, otherwise false
     */
    public boolean validateSignature(final Pair<Assertion, WsFederationConfiguration> resultPair) {
        if (resultPair == null) {
            LOGGER.warn("No assertion or its configuration was provided to validate signatures");
            return false;
        }
        val configuration = resultPair.getValue();
        val assertion = resultPair.getKey();

        if (assertion == null || configuration == null) {
            LOGGER.warn("No signature or configuration was provided to validate signatures");
            return false;
        }
        val signature = assertion.getSignature();
        if (signature == null) {
            LOGGER.warn("No signature is attached to the assertion to validate");
            return false;
        }
        try {
            LOGGER.debug("Validating the signature...");
            val validator = new SAMLSignatureProfileValidator();
            validator.validate(signature);

View on GitHub (pinned to e7288fc434)