What causes "Cannot verify SAML assertion signature." in bitwarden/server?

Download the IdP's current signing certificate and update it in the organization's SSO configuration in Bitwarden.

bitwarden/server · error · Exception

Cannot verify SAML assertion signature.

Error message

Cannot verify SAML assertion signature.

What it means

Thrown during SAML response validation when the service provider option WantAssertionsSigned is enabled and the incoming SAML assertion either has no signature or its signature cannot be verified against the identity provider's configured signing keys. Verification checks the signing certificate, certificate validation rules, and minimum signing algorithm strength.

Source

Thrown at bitwarden_license/src/Sso/Utilities/Saml2OptionsExtensions.cs:101

        {
            return false;
        }

        // Double check the entity Ids
        var entityId = envelope["Issuer", Saml2Namespaces.Saml2Name]?.InnerText.Trim();
        if (!string.Equals(entityId, idp.EntityId.Id, StringComparison.InvariantCultureIgnoreCase))
        {
            return false;
        }

        if (options.SPOptions.WantAssertionsSigned)
        {
            var assertion = envelope["Assertion", Saml2Namespaces.Saml2Name];
            var isAssertionSigned = assertion != null && XmlHelpers.IsSignedByAny(assertion, idp.SigningKeys,
                options.SPOptions.ValidateCertificates, options.SPOptions.MinIncomingSigningAlgorithm);
            if (!isAssertionSigned)
            {
                throw new Exception("Cannot verify SAML assertion signature.");
            }
        }

        return true;
    }
}

View on GitHub (pinned to e93b962371)

Solutions

Download the IdP's current signing certificate and update it in the organization's SSO configuration in Bitwarden.
Confirm the IdP signs the SAML Assertion element (not just the Response) when WantAssertionsSigned is true.
Verify MinIncomingSigningAlgorithm matches or is lower than the algorithm the IdP uses (prefer http://www.w3.org/2001/04/xmldsig-more#rsa-sha256).
If certificate validation (ValidateCertificates) is strict, ensure the IdP certificate chain is trusted and not expired.
As a last resort, disable WantAssertionsSigned if response-level signing is sufficient for your security model — but prefer fixing the IdP config.

Defensive patterns

Strategy: validation

Validate before calling

// Validate IdP certificate and signing config during SSO setup
if (ssoConfig.WantAssertionsSigned)
{
    if (string.IsNullOrEmpty(ssoConfig.SigningCertificate))
        return BadRequest("Signing certificate is required when WantAssertionsSigned is enabled.");
    if (ssoConfig.MinIncomingSigningAlgorithm == null)
        return BadRequest("Minimum signing algorithm must be specified.");
}

Try / catch

try { await samlService.ProcessResponseAsync(samlResponse); }
catch (Exception ex) when (ex.Message.Contains("Cannot verify SAML assertion signature"))
{ /* Show admin: update IdP signing cert in SSO settings, or verify IdP signs the assertion element */ }

Prevention

During IdP certificate rotation, update the Bitwarden SSO configuration before the old cert expires.
Test SSO with a SAML debugging tool (e.g., SAML Tracer) to confirm the assertion is signed.
Document the expected signing algorithm (prefer RSA-SHA256) in the SSO setup guide.
Set up monitoring/alerting for certificate expiry on the IdP side.

When it happens

Trigger: The IdP sends an unsigned assertion while the SP requires signed assertions. The IdP signs with a certificate not configured in Bitwarden's SSO settings. The signing algorithm is weaker than MinIncomingSigningAlgorithm. The certificate has rotated on the IdP side but not updated in Bitwarden.

Common situations: IdP certificate rotation without updating Bitwarden SSO configuration. WantAssertionsSigned enabled but IdP configured to sign only the response (not the assertion). Algorithm downgrade or SHA-1 being rejected when a SHA-256 minimum is set.

Related errors

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/5fb644a6ab6a9685. Report an issue: GitHub.