{"record":{"id":"c36fa162598bd5db","repo":"RocketChat/Rocket.Chat","slug":"unable-to-validate-signature","errorCode":null,"errorMessage":"Unable to validate signature","messagePattern":"Unable to validate signature","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/saml/lib/parsers/Response.ts","lineNumber":275,"sourceCode":"\n\t\treturn {\n\t\t\tassertion,\n\t\t\txml: newXml || xml,\n\t\t};\n\t}\n\n\tprivate verifySignatures(response: Element, assertionData: ISAMLAssertion, xml: string): void {\n\t\tconst signatureType = this.serviceProviderOptions.signatureValidationType;\n\n\t\tconst checkEither = signatureType === 'Either';\n\t\tconst checkResponse = signatureType === 'Response' || signatureType === 'All' || checkEither;\n\t\tconst checkAssertion = signatureType === 'Assertion' || signatureType === 'All' || checkEither;\n\t\tlet anyValidSignature = false;\n\n\t\tif (!this.serviceProviderOptions.cert) {\n\t\t\tif (checkResponse || checkAssertion) {\n\t\t\t\tSAMLUtils.log('Missing Signature validation params');\n\t\t\t\tthrow new Error('Unable to validate signature');\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\n\t\tif (checkResponse) {\n\t\t\tSAMLUtils.log('Verify Document Signature');\n\t\t\tif (!this.validateResponseSignature(xml, this.serviceProviderOptions.cert, response)) {\n\t\t\t\tif (!checkEither) {\n\t\t\t\t\tSAMLUtils.log('Document Signature WRONG');\n\t\t\t\t\tthrow new Error('Invalid Signature');\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tanyValidSignature = true;\n\t\t\t}\n\t\t\tSAMLUtils.log('Document Signature OK');\n\t\t}\n\n\t\tif (checkAssertion) {","sourceCodeStart":257,"sourceCodeEnd":293,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/saml/lib/parsers/Response.ts#L257-L293","documentation":"Error \"Unable to validate signature\" thrown in RocketChat/Rocket.Chat.","triggerScenarios":"Thrown when a signature is present in the SAML response but its validity cannot be checked (e.g. missing cert).","commonSituations":"See trigger scenarios.","solutions":["Verify the IdP signing certificate configured on the SP matches the certificate used to sign the response, and that the signature algorithm is supported."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}