{"record":{"id":"201af6d5af17733f","repo":"RocketChat/Rocket.Chat","slug":"too-many-saml-assertions","errorCode":null,"errorMessage":"Too many SAML assertions","messagePattern":"Too many SAML assertions","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/saml/lib/parsers/Response.ts","lineNumber":223,"sourceCode":"\t\t}\n\n\t\tSAMLUtils.log('Verify status');\n\t\tconst statusValidateObj = SAMLUtils.validateStatus(doc);\n\t\tif (!statusValidateObj.success) {\n\t\t\treturn callback(new Error(`Status is: ${statusValidateObj.statusCode}`), null, false);\n\t\t}\n\t\tSAMLUtils.log('Status ok');\n\n\t\t// @ToDo: Check if this situation is still used\n\t\treturn callback(null, null, true);\n\t}\n\n\tprivate getAssertion(response: Element, xml: string): ISAMLAssertion {\n\t\tconst allAssertions = response.getElementsByTagNameNS('urn:oasis:names:tc:SAML:2.0:assertion', 'Assertion');\n\t\tconst allEncrypedAssertions = response.getElementsByTagNameNS('urn:oasis:names:tc:SAML:2.0:assertion', 'EncryptedAssertion');\n\n\t\tif (allAssertions.length + allEncrypedAssertions.length > 1) {\n\t\t\tthrow new Error('Too many SAML assertions');\n\t\t}\n\n\t\tlet assertion: Element = allAssertions[0];\n\t\tconst encAssertion = allEncrypedAssertions[0];\n\t\tlet newXml = null;\n\n\t\tif (typeof encAssertion !== 'undefined') {\n\t\t\t// disallowDecryptionWithInsecureAlgorithm defaults to true in xml-encryption v4, but AES-CBC/3DES\n\t\t\t// are still widely used by SAML IdPs in practice, so we keep the pre-v4 behaviour here.\n\t\t\tconst options = { key: this.serviceProviderOptions.privateKey, disallowDecryptionWithInsecureAlgorithm: false };\n\t\t\tconst encData = encAssertion.getElementsByTagNameNS('*', 'EncryptedData')[0];\n\t\t\txmlenc.decrypt(encData, options, (err, result) => {\n\t\t\t\tif (err) {\n\t\t\t\t\tSAMLUtils.error(err);\n\t\t\t\t}\n\n\t\t\t\tconst document = new xmldom.DOMParser().parseFromString(result, 'text/xml');\n\t\t\t\tif (!document) {","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/saml/lib/parsers/Response.ts#L205-L241","documentation":"Error \"Too many SAML assertions\" thrown in RocketChat/Rocket.Chat.","triggerScenarios":"Thrown when a SAML Response contains more than one Assertion node, which is not supported.","commonSituations":"See trigger scenarios.","solutions":["Check the IdP configuration so it returns a single assertion per response; inspect the raw SAML response for duplicates."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}