{"record":{"id":"f51cacba8ebab030","repo":"apereo/cas","slug":"no-signature-is-attached-to-the-assertion-to-valid","errorCode":null,"errorMessage":"No signature is attached to the assertion to validate","messagePattern":"No signature is attached to the assertion to validate","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-wsfederation/src/main/java/org/apereo/cas/support/wsfederation/WsFederationHelper.java","lineNumber":264,"sourceCode":"     *\n     * @param resultPair a provided assertion\n     * @return true if the assertion's signature is valid, otherwise false\n     */\n    public boolean validateSignature(final Pair<Assertion, WsFederationConfiguration> resultPair) {\n        if (resultPair == null) {\n            LOGGER.warn(\"No assertion or its configuration was provided to validate signatures\");\n            return false;\n        }\n        val configuration = resultPair.getValue();\n        val assertion = resultPair.getKey();\n\n        if (assertion == null || configuration == null) {\n            LOGGER.warn(\"No signature or configuration was provided to validate signatures\");\n            return false;\n        }\n        val signature = assertion.getSignature();\n        if (signature == null) {\n            LOGGER.warn(\"No signature is attached to the assertion to validate\");\n            return false;\n        }\n        try {\n            LOGGER.debug(\"Validating the signature...\");\n            val validator = new SAMLSignatureProfileValidator();\n            validator.validate(signature);\n\n            val criteriaSet = new CriteriaSet();\n            criteriaSet.add(new UsageCriterion(UsageType.SIGNING));\n            criteriaSet.add(new EntityRoleCriterion(IDPSSODescriptor.DEFAULT_ELEMENT_NAME));\n            criteriaSet.add(new ProtocolCriterion(SAMLConstants.SAML20P_NS));\n            criteriaSet.add(new EntityIdCriterion(configuration.getIdentityProviderIdentifier()));\n            val engine = buildSignatureTrustEngine(configuration);\n            LOGGER.debug(\"Validating signature via trust engine for [{}]\", configuration.getIdentityProviderIdentifier());\n            return engine.validate(signature, criteriaSet);\n        } catch (final Exception e) {\n            LoggingUtils.error(LOGGER, \"Failed to validate assertion signature\", e);\n        }","sourceCodeStart":246,"sourceCodeEnd":282,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-wsfederation/src/main/java/org/apereo/cas/support/wsfederation/WsFederationHelper.java#L246-L282","documentation":"validateSignature checks assertion.getSignature() before validating; a null signature means the assertion is unsigned, so it logs this warning and returns false. WS-Federation trust relies on signed assertions, so an unsigned token is rejected.","triggerScenarios":"IdP sends an unsigned SAML assertion (signing disabled at the IdP or the signature stripped during processing), so getSignature() returns null.","commonSituations":"IdP configured without token-signing certificate; wrong binding/encoding that loses the signature; assertion rebuilt after decrypt which dropped the signature; testing with an unsigned assertion template.","solutions":["Enable assertion/token signing on the identity provider and import its signing certificate into CAS configuration.","Verify the full wresult reaches CAS unmodified (no proxy rewriting the XML).","Confirm you are validating the original assertion element, not a re-serialized copy that lost the signature.","If your deployment intentionally allows unsigned assertions, add explicit opt-in handling — by design this helper rejects them."],"exampleFix":"// ADFS before\nSet-AdfsRelyingPartyTrust -TargetName CAS -SamlResponseSignature None\n// after\nSet-AdfsRelyingPartyTrust -TargetName CAS -SamlResponseSignature MessageAndAssertion","handlingStrategy":"validation","validationCode":"if (assertion.getSignature() == null) {\n    LOGGER.error(\"Assertion from {} is unsigned; refusing validation\", assertion.getIssuer().getValue());\n}\n","typeGuard":"boolean isSigned(Assertion a) {\n    return a != null && a.getSignature() != null;\n}","tryCatchPattern":null,"preventionTips":["Require signed assertions at the IdP (ADF: SamlResponseSignature MessageAndAssertion).","Verify no intermediary (proxy/gateway) rewrites the SAML XML.","Keep the IdP signing certificate imported and unexpired in CAS config."],"tags":["ws-federation","saml","unsigned-assertion","signature"],"backgroundTag":"schema-validation-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}