{"record":{"id":"957a53d447699e07","repo":"apereo/cas","slug":"ws-requested-security-token-is-blank-or-the-signat","errorCode":null,"errorMessage":"WS Requested Security Token is blank or the signature is not valid.","messagePattern":"WS Requested Security Token is blank or the signature is not valid\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-wsfederation-webflow/src/main/java/org/apereo/cas/web/flow/WsFederationResponseValidator.java","lineNumber":71,"sourceCode":"        val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(context);\n        val wResult = request.getParameter(WRESULT);\n        LOGGER.debug(\"Parameter [{}] received: [{}]\", WRESULT, wResult);\n        if (StringUtils.isBlank(wResult)) {\n            LOGGER.error(\"No [{}] parameter is found\", WRESULT);\n            throw new IllegalArgumentException(\"Missing parameter \" + WRESULT);\n        }\n        LOGGER.debug(\"Attempting to create an assertion from the token parameter\");\n        val rsToken = wsFederationHelper.getRequestSecurityTokenFromResult(wResult);\n        val assertion = wsFederationHelper.buildAndVerifyAssertion(rsToken, configurations, service);\n        if (assertion == null) {\n            LOGGER.error(\"Could not validate assertion via parsing the token from [{}]\", WRESULT);\n            throw new IllegalArgumentException(\"Could not validate assertion via the provided token\");\n        }\n        LOGGER.debug(\"Attempting to validate the signature on the assertion\");\n        if (!wsFederationHelper.validateSignature(assertion)) {\n            val msg = \"WS Requested Security Token is blank or the signature is not valid.\";\n            LOGGER.error(msg);\n            throw new IllegalArgumentException(msg);\n        }\n        buildCredentialsFromAssertion(context, assertion, service);\n    }\n\n    private void buildCredentialsFromAssertion(final RequestContext context,\n                                               final Pair<Assertion, WsFederationConfiguration> assertion,\n                                               final Service service) throws Throwable {\n        try {\n            LOGGER.debug(\"Creating credential based on the provided assertion\");\n            val credential = wsFederationHelper.createCredentialFromToken(assertion.getKey());\n            val configuration = assertion.getValue();\n            val rpId = wsFederationHelper.getRelyingPartyIdentifier(service, configuration);\n\n            if (credential == null) {\n                LOGGER.error(\"No credential could be extracted from [{}] based on relying party identifier [{}] and identity provider identifier [{}]\",\n                    assertion.getKey(), rpId, configuration.getIdentityProviderIdentifier());\n                throw new IllegalArgumentException(\"Could not extract and identify credentials\");\n            }","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-wsfederation-webflow/src/main/java/org/apereo/cas/web/flow/WsFederationResponseValidator.java#L53-L89","documentation":"Thrown by WsFederationResponseValidator.validateWsFederationAuthenticationRequest when WsFederationHelper.validateSignature(assertion) returns false after the assertion was extracted from the WS-Federation security token. It means the SAML assertion could not be cryptographically validated against the identity provider's signing certificate configured in WsFederationConfiguration. CAS refuses to build credentials from an assertion whose signature cannot be trusted.","triggerScenarios":"The security token parses into an assertion but wsFederationHelper.validateSignature fails: the IdP signing certificate/trust store in WsFederationConfiguration does not match the certificate the IdP actually used to sign the token, the token was tampered with or truncated, or the assertion is blank/empty.","commonSituations":"Misconfigured signing certificate (wrong keystore, wrong alias, expired IdP certificate rotated on the IdP side but not in CAS), importing tokens from a different ADFS/AD FS farm than the one configured, copy-pasting an encoded token that got mangled, or clock/issuer mismatches causing validation helper failures.","solutions":["Verify the signing certificate in WsFederationConfiguration (setSigningCertificate / trust store) matches the current IdP token-signing certificate; re-export the IdP's Token-Signing cert from ADFS and update CAS.","Confirm the request's wresult security token is complete and unmodified (no HTML-escaping or truncation in transit or in logs/tests).","Check the IdP did not rotate its signing certificate; fetch the updated federation metadata and update CAS config.","Enable DEBUG logging on org.apereo.cas.support.wsfederation to see the underlying signature validation failure detail."],"exampleFix":"// before: stale signing cert configured\nconf.setSigningCertificate(\"MIICxDCCAjCg...\"); // old ADFS cert\n// after: current IdP token-signing certificate\nconf.setSigningCertificate(currentAdfsTokenSigningCertBase64);","handlingStrategy":"validation","validationCode":"// before validation flow, confirm signing key material is present and loadable\nif (configuration.getSigningCertificate() == null && configuration.getKeystorePath() == null) {\n    throw new IllegalStateException(\"WsFederation configuration has no signing certificate or keystore; token signature validation will fail\");\n}","typeGuard":"function hasSigningKey(config) {\n  return Boolean(config.getSigningCertificate?.() || config.getKeystorePath?.());\n}","tryCatchPattern":"try {\n    validator.validateWsFederationAuthenticationRequest(context);\n} catch (IllegalArgumentException e) {\n    LOGGER.error(\"WS-Fed token signature invalid; verify IdP signing cert vs CAS config: {}\", e.getMessage());\n    throw new BadWsFederationResponseException(\"untrusted-token\");\n}","preventionTips":["Track IdP certificate rotation (ADFS Token-Signing cert) and update CAS config proactively via federation metadata.","Keep the signing certificate in a managed keystore and test signature validation after any IdP change.","Never hand-edit or re-encode captured wresult tokens in tests."],"tags":["ws-federation","signature-validation","saml-assertion","certificate-mismatch"],"backgroundTag":"schema-validation-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}