EntraID SAML does not recognize signature

Alon Kedar-Haspel 0 Reputation points
2024-07-09T09:29:54.89+00:00

I have an application which supports integration with SAML. One of the providers I support is EntraID. I have recently added the option to sign the authnrequests, and it works just fine against most of the providers I support. Against EntraID, however, it does not work.

Here is the request being sent, and along side it the response I am getting:

User's image

This same request works just fine when I try it against other providers which I will not name here, but are reliant.

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
21,703 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Sandeep G-MSFT 19,021 Reputation points Microsoft Employee
    2024-07-09T14:36:56.56+00:00

    @Alon Kedar-Haspel

    Thank you for posting this in Microsoft Q&A.

    This error comes in when you have enabled one of the features "SAML Request Signature Verification" and when either the application is not sending the signed SAML authentication request to AAD or in Azure AD you have not uploaded the correct certificate for it to validate the authentication request.

    To fix this issue you can check and confirm if correct certificate is uploaded. To check this, you can follow below steps,

    • Login to Azure AD portal.
    • Access Azure active directory blade.
    • Click on Enterprise applications blade.
    • Once you see list of all configured application you can click on the application for which you are getting an error.
    • Click on Single sign-on blade and then look at "Verification certificates (optional) (Preview)" on the right pane.

    User's image

    • Confirm if the certificate uploaded is the correct one.

    If Azure AD has the correct certificate, then the issue might be from the application side. Application might not be sending the signed SAML authentication request to AAD.

    Let me know if you have any further questions. This error comes in when you have enabled one of the preview features "SAML Request Signature Verification" and when either the application is not sending the signed SAML authentication request to AAD or in Azure AD you have not uploaded the correct certificate for it to validate the authentication request.

    To fix this issue you can check and confirm if correct certificate is uploaded. To check this, you can follow below steps,

    • Login to Azure AD portal.
    • Access Azure active directory blade.
    • Click on Enterprise applications blade.
    • Once you see list of all configured application you can click on the application for which you are getting an error.
    • Click on Single sign-on blade and then look at "Verification certificates (optional) (Preview)" on the right pane.

    User's image

    • Confirm if the certificate uploaded is the correct one.

    If Azure AD has the correct certificate, then the issue might be from the application side. Application might not be sending the signed SAML authentication request to AAD.

    Let me know if you have any further questions.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.