{"record":{"id":"5fb644a6ab6a9685","repo":"bitwarden/server","slug":"cannot-verify-saml-assertion-signature","errorCode":null,"errorMessage":"Cannot verify SAML assertion signature.","messagePattern":"Cannot verify SAML assertion signature\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"bitwarden_license/src/Sso/Utilities/Saml2OptionsExtensions.cs","lineNumber":101,"sourceCode":"        {\n            return false;\n        }\n\n        // Double check the entity Ids\n        var entityId = envelope[\"Issuer\", Saml2Namespaces.Saml2Name]?.InnerText.Trim();\n        if (!string.Equals(entityId, idp.EntityId.Id, StringComparison.InvariantCultureIgnoreCase))\n        {\n            return false;\n        }\n\n        if (options.SPOptions.WantAssertionsSigned)\n        {\n            var assertion = envelope[\"Assertion\", Saml2Namespaces.Saml2Name];\n            var isAssertionSigned = assertion != null && XmlHelpers.IsSignedByAny(assertion, idp.SigningKeys,\n                options.SPOptions.ValidateCertificates, options.SPOptions.MinIncomingSigningAlgorithm);\n            if (!isAssertionSigned)\n            {\n                throw new Exception(\"Cannot verify SAML assertion signature.\");\n            }\n        }\n\n        return true;\n    }\n}\n","sourceCodeStart":83,"sourceCodeEnd":108,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/bitwarden_license/src/Sso/Utilities/Saml2OptionsExtensions.cs#L83-L108","documentation":"Thrown during SAML response validation when the service provider option WantAssertionsSigned is enabled and the incoming SAML assertion either has no signature or its signature cannot be verified against the identity provider's configured signing keys. Verification checks the signing certificate, certificate validation rules, and minimum signing algorithm strength.","triggerScenarios":"The IdP sends an unsigned assertion while the SP requires signed assertions. The IdP signs with a certificate not configured in Bitwarden's SSO settings. The signing algorithm is weaker than MinIncomingSigningAlgorithm. The certificate has rotated on the IdP side but not updated in Bitwarden.","commonSituations":"IdP certificate rotation without updating Bitwarden SSO configuration. WantAssertionsSigned enabled but IdP configured to sign only the response (not the assertion). Algorithm downgrade or SHA-1 being rejected when a SHA-256 minimum is set.","solutions":["Download the IdP's current signing certificate and update it in the organization's SSO configuration in Bitwarden.","Confirm the IdP signs the SAML Assertion element (not just the Response) when WantAssertionsSigned is true.","Verify MinIncomingSigningAlgorithm matches or is lower than the algorithm the IdP uses (prefer http://www.w3.org/2001/04/xmldsig-more#rsa-sha256).","If certificate validation (ValidateCertificates) is strict, ensure the IdP certificate chain is trusted and not expired.","As a last resort, disable WantAssertionsSigned if response-level signing is sufficient for your security model — but prefer fixing the IdP config."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Validate IdP certificate and signing config during SSO setup\nif (ssoConfig.WantAssertionsSigned)\n{\n    if (string.IsNullOrEmpty(ssoConfig.SigningCertificate))\n        return BadRequest(\"Signing certificate is required when WantAssertionsSigned is enabled.\");\n    if (ssoConfig.MinIncomingSigningAlgorithm == null)\n        return BadRequest(\"Minimum signing algorithm must be specified.\");\n}","typeGuard":null,"tryCatchPattern":"try { await samlService.ProcessResponseAsync(samlResponse); }\ncatch (Exception ex) when (ex.Message.Contains(\"Cannot verify SAML assertion signature\"))\n{ /* Show admin: update IdP signing cert in SSO settings, or verify IdP signs the assertion element */ }","preventionTips":["During IdP certificate rotation, update the Bitwarden SSO configuration before the old cert expires.","Test SSO with a SAML debugging tool (e.g., SAML Tracer) to confirm the assertion is signed.","Document the expected signing algorithm (prefer RSA-SHA256) in the SSO setup guide.","Set up monitoring/alerting for certificate expiry on the IdP side."],"tags":["sso","saml","security","certificate","signing","bitwarden-license"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}