ERR_FAILED_TO_VERIFY_SIGNATURE when parsing SAML response

[DrJest]

Hi,
I'm trying to build a SP on top of samlify. Everything works fine until I get the response from the IDP. Then I get ERR_FAILED_TO_VERIFY_SIGNATURE.
I tried to verify the signature with the parseLoginResponse and the sig.checkSignature of xml-crypto, but both of them give invalid signature.
But, by copy-pasting the response from the console to https://www.samltool.com/validate_response.php I get a valid response.
Both the response and the assertion are signed. guess that might be the problem?

[tngan]

@DrJest Here is the example for working with signed message + signed assertion.

If you don't mind to share the response (taking out the sensitive information), and send to [email protected].

samlify/test/flow.ts

Lines 736 to 750 in 9a56afd

	test('send login response with signed assertion + signed message and parse it', async t => {
	const spWantMessageSign = serviceProvider({
	...defaultSpConfig,
	wantMessageSigned: true,
	});
	const user = { email: '[email protected]' };
	const { id, context: SAMLResponse } = await idpNoEncrypt.createLoginResponse(spWantMessageSign, sampleRequestInfo, 'post', user, createTemplateCallback(idpNoEncrypt, spWantMessageSign, binding.post, user));
	// receiver (caution: only use metadata and public key when declare pair-up in oppoent entity)
	const { samlContent, extract } = await spWantMessageSign.parseLoginResponse (idpNoEncrypt, 'post', { body: { SAMLResponse } });
	t.is(typeof id, 'string');
	t.is(samlContent.startsWith('<samlp:Response'), true);
	t.is(samlContent.endsWith('/samlp:Response>'), true);
	t.is(extract.nameID, '[email protected]');
	t.is(extract.response.inResponseTo, 'request_id');
	});

[Sf-Skaylink]

Hey @tngan and @DrJest ,
I have the same problem, could you find a solution?
Interesting is that I use the chrome extension SAML-tracer and i'm definitely getting a correct SAML response incl. bearer token back. i just can't use it because the parseLoginResponse fails due to the error.

[liviu-gheorghe]

Same problem here, can anyone help?