Issue with Azure AD metadata import in linux based system with Tomcat as application server

amitava hazra 6 Reputation points
2020-07-02T15:59:57.9+00:00

Facing issue while importing SAML SSO Azure AD IDP metadata in SP (Linux based system. Tomcat as application server).

Error:
SignatureValidationFilter : Signature trust establishment failed for metadata entry https://sts.windows.net/XXXXXXXXXX.

We also have added certificate to java key store but still having signature trust establishment error.

When we are modifying setMetadataTrustCheck to false SSO is working.
How can we work it with setMetaDataTrustCheck to true?
Also what is the significance of setMetadataTrustCheck ?

Can anyone please help.

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
21,439 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Marilee Turscak-MSFT 36,841 Reputation points Microsoft Employee
    2020-07-28T17:20:02.323+00:00

    Hi @amitava hazra ,

    This error usually means that your trust is invalid. Do you have all of the required certificates in your trust store?

    This can happen if you have imported the HTTPS certificate, but not the certificate which is used to create the signature.

    If you are still having this issue feel free to send me an email at AzCommunity@microsoft.com and I can get a support case opened for you.

    0 comments
  2. JaparJarkynbyek 41 Reputation points
    2020-08-17T06:43:58.467+00:00

    @MarileeTurscak Hello,

    I also encountered this problem I am created sample spring boot service provider. I applied SSL to localhost app using local keystore generated certificate.
    My question is which signature am I import to my trust store? If possible can you give me example?

    OS: WINDOWS 10
    Error is:

    2020-08-17 15:35:41.196 ERROR 23496 --- [nio-8080-exec-9] o.o.s.m.p.SignatureValidationFilter : Signature trust establishment failed for metadata entry https://sts.windows.net/xxxxxxxxxxxxxxxxxxxxxxxxxxx/

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.