apereo/cas · warning

No signature is attached to the assertion to validate

Error message

No signature is attached to the assertion to validate

What it means

validateSignature checks assertion.getSignature() before validating; a null signature means the assertion is unsigned, so it logs this warning and returns false. WS-Federation trust relies on signed assertions, so an unsigned token is rejected.

Solutions

1. Enable assertion/token signing on the identity provider and import its signing certificate into CAS configuration.
2. Verify the full wresult reaches CAS unmodified (no proxy rewriting the XML).
3. Confirm you are validating the original assertion element, not a re-serialized copy that lost the signature.
4. If your deployment intentionally allows unsigned assertions, add explicit opt-in handling — by design this helper rejects them.

Example fix

// ADFS before
Set-AdfsRelyingPartyTrust -TargetName CAS -SamlResponseSignature None
// after
Set-AdfsRelyingPartyTrust -TargetName CAS -SamlResponseSignature MessageAndAssertion

if (assertion.getSignature() == null) {
    LOGGER.error("Assertion from {} is unsigned; refusing validation", assertion.getIssuer().getValue());
}

boolean isSigned(Assertion a) {
    return a != null && a.getSignature() != null;
}

When it happens

Trigger: IdP sends an unsigned SAML assertion (signing disabled at the IdP or the signature stripped during processing), so getSignature() returns null.

Common situations: IdP configured without token-signing certificate; wrong binding/encoding that loses the signature; assertion rebuilt after decrypt which dropped the signature; testing with an unsigned assertion template.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• No assertion or its configuration was provided to validate…
• No signature or configuration was provided to validate…
• Request is not signed but should be
• Proof JWT signature validation failed
• JWK type is not supported

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/f51cacba8ebab030. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-wsfederation/src/main/java/org/apereo/cas/support/wsfederation/WsFederationHelper.java:264

     *
     * @param resultPair a provided assertion
     * @return true if the assertion's signature is valid, otherwise false
     */
    public boolean validateSignature(final Pair<Assertion, WsFederationConfiguration> resultPair) {
        if (resultPair == null) {
            LOGGER.warn("No assertion or its configuration was provided to validate signatures");
            return false;
        }
        val configuration = resultPair.getValue();
        val assertion = resultPair.getKey();

        if (assertion == null || configuration == null) {
            LOGGER.warn("No signature or configuration was provided to validate signatures");
            return false;
        }
        val signature = assertion.getSignature();
        if (signature == null) {
            LOGGER.warn("No signature is attached to the assertion to validate");
            return false;
        }
        try {
            LOGGER.debug("Validating the signature...");
            val validator = new SAMLSignatureProfileValidator();
            validator.validate(signature);

            val criteriaSet = new CriteriaSet();
            criteriaSet.add(new UsageCriterion(UsageType.SIGNING));
            criteriaSet.add(new EntityRoleCriterion(IDPSSODescriptor.DEFAULT_ELEMENT_NAME));
            criteriaSet.add(new ProtocolCriterion(SAMLConstants.SAML20P_NS));
            criteriaSet.add(new EntityIdCriterion(configuration.getIdentityProviderIdentifier()));
            val engine = buildSignatureTrustEngine(configuration);
            LOGGER.debug("Validating signature via trust engine for [{}]", configuration.getIdentityProviderIdentifier());
            return engine.validate(signature, criteriaSet);
        } catch (final Exception e) {
            LoggingUtils.error(LOGGER, "Failed to validate assertion signature", e);
        }

View on GitHub (pinned to e7288fc434)