{"record":{"id":"7e37a408fdacdb55","repo":"apereo/cas","slug":"could-not-validate-assertion-via-the-provided-toke","errorCode":null,"errorMessage":"Could not validate assertion via the provided token","messagePattern":"Could not validate assertion via the provided token","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-wsfederation-webflow/src/main/java/org/apereo/cas/web/flow/WsFederationResponseValidator.java","lineNumber":65,"sourceCode":"     * @throws Throwable the throwable\n     */\n    public void validateWsFederationAuthenticationRequest(final RequestContext context) throws Throwable {\n        val service = wsFederationCookieManager.retrieve(context);\n        LOGGER.debug(\"Retrieved service [{}] from the session cookie\", service);\n\n        val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(context);\n        val wResult = request.getParameter(WRESULT);\n        LOGGER.debug(\"Parameter [{}] received: [{}]\", WRESULT, wResult);\n        if (StringUtils.isBlank(wResult)) {\n            LOGGER.error(\"No [{}] parameter is found\", WRESULT);\n            throw new IllegalArgumentException(\"Missing parameter \" + WRESULT);\n        }\n        LOGGER.debug(\"Attempting to create an assertion from the token parameter\");\n        val rsToken = wsFederationHelper.getRequestSecurityTokenFromResult(wResult);\n        val assertion = wsFederationHelper.buildAndVerifyAssertion(rsToken, configurations, service);\n        if (assertion == null) {\n            LOGGER.error(\"Could not validate assertion via parsing the token from [{}]\", WRESULT);\n            throw new IllegalArgumentException(\"Could not validate assertion via the provided token\");\n        }\n        LOGGER.debug(\"Attempting to validate the signature on the assertion\");\n        if (!wsFederationHelper.validateSignature(assertion)) {\n            val msg = \"WS Requested Security Token is blank or the signature is not valid.\";\n            LOGGER.error(msg);\n            throw new IllegalArgumentException(msg);\n        }\n        buildCredentialsFromAssertion(context, assertion, service);\n    }\n\n    private void buildCredentialsFromAssertion(final RequestContext context,\n                                               final Pair<Assertion, WsFederationConfiguration> assertion,\n                                               final Service service) throws Throwable {\n        try {\n            LOGGER.debug(\"Creating credential based on the provided assertion\");\n            val credential = wsFederationHelper.createCredentialFromToken(assertion.getKey());\n            val configuration = assertion.getValue();\n            val rpId = wsFederationHelper.getRelyingPartyIdentifier(service, configuration);","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-wsfederation-webflow/src/main/java/org/apereo/cas/web/flow/WsFederationResponseValidator.java#L47-L83","documentation":"After extracting wresult, the validator calls wsFederationHelper.buildAndVerifyAssertion to parse and verify the RequestSecurityToken into a SAML assertion. If the helper returns null (token unparseable or verification failed), it throws IllegalArgumentException stating the assertion could not be validated from the provided token.","triggerScenarios":"buildAndVerifyAssertion(rsToken, configurations, service) returns null for the wresult token — malformed token XML, unsigned or improperly signed token, or service configuration (signing cert / entity id) that does not verify the assertion.","commonSituations":"IdP signing certificate rotated or changed without updating the WS-Fed service registration in CAS; clock skew making the assertion invalid; wrong relying-party trust configuration (mismatched entity ID or certificate) so signature verification silently fails; truncated wresult due to URL-encoding or proxy mangling.","solutions":["Verify the WS-Fed service registration in CAS holds the current IdP signing certificate and correct entity/realm IDs.","Enable debug logging on WsFederationHelper and WsFederationResponseValidator to see why the assertion failed to build/verify (parse error vs signature).","Re-test with a freshly minted sign-in response to rule out expired/replayed or truncated token payloads.","Synchronize clocks (NTP) on IdP and CAS to eliminate time-based assertion validation failures."],"exampleFix":"// before: stale certificate in CAS service registration\n\"signingCertificate\": \"MIIB...OLD-EXPIRED-CERT...\",\n// after: current IdP signing certificate\n\"signingCertificate\": \"MIIB...CURRENT-IDP-CERT...\"","handlingStrategy":"try-catch","validationCode":"// Pre-check that the token is well-formed XML before handing it off:\nDocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();\ndbf.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\ndbf.newDocumentBuilder().parse(new InputSource(new StringReader(wresult)));","typeGuard":null,"tryCatchPattern":"try {\n    validator.validateWsFederationAuthenticationRequest(context);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"Could not validate assertion\")) {\n        // refresh IdP signing cert / check service trust config, then re-authenticate\n        throw new AuthenticationException(\"WS-Fed assertion rejected\", e);\n    }\n    throw e;\n}","preventionTips":["Rotate IdP signing certificates in CAS service registrations before IdP-side expiry.","Keep IdP and CAS clocks synchronized via NTP.","Enable debug logging on WsFederationHelper when onboarding a new IdP to catch verification failures immediately.","Confirm the wresult payload is not truncated or double-URL-encoded in transit."],"tags":["ws-federation","saml-assertion","signature-verification"],"backgroundTag":"schema-validation-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}