apereo/cas · warning

No signature or configuration was provided to validate…

Error message

No signature or configuration was provided to validate signatures

What it means

In validateSignature, after confirming the pair exists, either the assertion or its WsFederationConfiguration being null also yields this warning and a false return. Signature validation requires both the assertion and configuration (trusted issuer/cert settings).

Solutions

1. Ensure the WsFederationConfiguration is fully built (signing certificate/keystore, issuer) before validation.
2. Verify the assertion extraction step returns a non-null Assertion for valid wresult payloads.
3. Log/inspect the pair construction site to find which element is null and fix its producer.

Example fix

// before
val pair = Pair.of(maybeAssertion, null);
// after
val pair = Pair.of(assertion, wsFederationConfiguration);

if (pair == null || pair.getKey() == null || pair.getValue() == null) {
    throw new IllegalStateException("validateSignature requires non-null assertion and configuration");
}

boolean isValidateInput(Pair<Assertion, WsFederationConfiguration> p) {
    return p != null && p.getKey() != null && p.getValue() != null;
}

When it happens

Trigger: resultPair constructed with one side null — e.g. Pair(null, config) or Pair(assertion, null) — typically from a partially failed parse or incorrectly built configuration object.

Common situations: WsFederationConfiguration bean not populated (missing properties); assertion unmarshalling failed silently producing null; code refactors swapping pair order.

Related errors

• No assertion or its configuration was provided to validate…
• No signature is attached to the assertion to validate
• Request is not signed but should be
• Proof JWT signature validation failed
• JWK type is not supported

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/7427be341f6e1931. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-wsfederation/src/main/java/org/apereo/cas/support/wsfederation/WsFederationHelper.java:259

        return reqToken.getSecurityTokens().getFirst();
    }

    /**
     * validateSignature checks to see if the signature on an assertion is valid.
     *
     * @param resultPair a provided assertion
     * @return true if the assertion's signature is valid, otherwise false
     */
    public boolean validateSignature(final Pair<Assertion, WsFederationConfiguration> resultPair) {
        if (resultPair == null) {
            LOGGER.warn("No assertion or its configuration was provided to validate signatures");
            return false;
        }
        val configuration = resultPair.getValue();
        val assertion = resultPair.getKey();

        if (assertion == null || configuration == null) {
            LOGGER.warn("No signature or configuration was provided to validate signatures");
            return false;
        }
        val signature = assertion.getSignature();
        if (signature == null) {
            LOGGER.warn("No signature is attached to the assertion to validate");
            return false;
        }
        try {
            LOGGER.debug("Validating the signature...");
            val validator = new SAMLSignatureProfileValidator();
            validator.validate(signature);

            val criteriaSet = new CriteriaSet();
            criteriaSet.add(new UsageCriterion(UsageType.SIGNING));
            criteriaSet.add(new EntityRoleCriterion(IDPSSODescriptor.DEFAULT_ELEMENT_NAME));
            criteriaSet.add(new ProtocolCriterion(SAMLConstants.SAML20P_NS));
            criteriaSet.add(new EntityIdCriterion(configuration.getIdentityProviderIdentifier()));
            val engine = buildSignatureTrustEngine(configuration);

View on GitHub (pinned to e7288fc434)