Invalid Signature #321

FedeFressiel · 2023-08-24T17:17:35Z

FedeFressiel
Aug 24, 2023

Hey everyone,
I'm trying to log in using Azure.
I've created the app, added a cert, and placed the same cert in the Nodejs project, where I run the SAML validation.
When I receive the callback and try validatePostResponseAsync, I always get "Invalid document signature".
The error is so generic that I don't know what I am doing wrong.
Any ideas? Would you happen to have any sample projects somewhere?
Sorry for my ignorance. I appreciate any help you can provide me with.

markstos · 2023-08-24T19:20:31Z

markstos
Aug 24, 2023
Maintainer

You didn't mention which version of passport-saml or node-saml you are using, but you can search the code for that error message and review exactly the conditions under which it is thrown:

node-saml/src/saml.ts

Line 713 in cbe102a

    
           if (this.options.wantAuthnResponseSigned === true && validSignature === false) {

Use tools or logging to review exact SAML messages sent across the wire, and use SAML tools like the one available here to further decode them

https://www.samltool.com/

Also look for SAML-specific browser extensions that may help with these tasks.

0 replies

srd90 · 2023-08-24T19:23:47Z

srd90
Aug 24, 2023

You probably did not read @node-saml/node-saml documentation regarding signatures and cross check with whats being configured to your IdP. See wantAssertionsSigned and wantAuthnResponseSigned from https://github.com/node-saml/node-saml/blob/v4.0.5/README.md . Furthermore it usually helps if you provide exact version number and some sample authn response (with sensitive information removed).

Here is long list of similar issues:

[BUG] When validating the SAML Response, it is assumed that the SAML Response ID attribute is the same as the SAML Assertion ID attribute #211
[BUG] Invalid document signature after upgrading from 2.2.0 to 4.0.1 passport-saml#816
- aforementioned issue is e.g. from azure case and contains a hint how to reconfigure azure if you choose to do so
[BUG] After an upgrade from passport-saml to @node-saml/passport-saml, assertion validation stopped working with HTTP-POST binding with an error: SAML.validatePostResponseAsync, Invalid document signature passport-saml#839
Assertion signature is missing in SAML Response when using Google Workspace passport-saml#852
[BUG] Invalid document signature passport-saml#859
Reference id not matching with documentElement id passport-saml#863
Assertion signature is missing in SAML Response when using Google Workspace passport-saml#865
Can't find the signature - Invalid document signature passport-saml#870

Wiki entry at @node-saml/passport-saml side: https://github.com/node-saml/passport-saml/wiki/Common-Issues

Here is (scoll down a bit this answer) node-saml/passport-saml#671 (reply in thread) sample how to spot from saml authn response how your IdP is configured at the moment and after that you have possibility to change your SP side configuration, reconfigure IdP side etc...

If you have to work with ADFS also here is a hint how to reconfigure it if you choose to do so node-saml/passport-saml#840 (comment)

You might ask if it is safe to go with only assertion or message level signature. It is up to you to decide based on your use cases what to do (See this node-saml/passport-saml#865 (comment) )

0 replies

FedeFressiel · 2023-08-25T13:27:14Z

FedeFressiel
Aug 25, 2023
Author

Hello guys!
Thank you for your quick response.
I am not using Passport.
Using SAML tools, I've decoded the response. I have the same cert (without the header and footer) I have in the creds.
I am using the following:
const { SAML } = require('@node-saml/node-saml'); var options = { entryPoint: 'https://login.microsoftonline.com/##/saml2', issuer: '##', callbackUrl: 'http://localhost:9000/ssocallback', cert:cert, identifierFormat: null, };
then in the callback endpoint
saml.validatePostResponseAsync(req.body).then(profile=> {}).catch(e=>{/*invalid document signature*/))

I don't know if I am missing something in the request or on Azure.
I would expect to get the user profile to check its IDs to validate access.
I am pretty sure that it's my ignorance that's stopping me :P

1 reply

srd90 Aug 25, 2023

You wrote:

I am not using Passport.

Behind the scene @node-saml/passport-saml >= 4.0.0 uses @node-saml/node-saml. Configuration options are same (although @node-saml/passport-saml side documentation is not up-to-date).

These sort of issues tend to be the same and thus solutions tend to be the same.

Quotes from: #321 (comment)

...
...See wantAssertionsSigned and wantAuthnResponseSigned from https://github.com/node-saml/node-saml/blob/v4.0.5/README.md . Furthermore it usually helps if you provide exact version number and some sample authn response (with sensitive information removed).
...
2. node-saml/passport-saml#816

aforementioned issue is e.g. from azure case and contains a hint how to reconfigure azure if you choose to do so

...

Still no version information or sample of authentication response you have received from AzureAD.

Based on your configuration which is prettified to below for the sake of readability:

const { SAML } = require('@node-saml/node-saml');
var options = {
 entryPoint: 'https://login.microsoftonline.com/##/saml2',
 issuer: '##',
 callbackUrl: 'http://localhost:9000/ssocallback',
 cert:cert,
 identifierFormat: null,
};

you are going with default configurations with wantAssertionsSigned and wantAuthnResponseSigned i.e. your @node-saml/node-saml instance expects signed assertion and signed response. Based on information from node-saml/passport-saml#816 AzureAD signs by default only assertion. Try to add:

  wantAuthnResponseSigned: false,

If your want to alter AzureAD side configuration so that it signs also response see node-saml/passport-saml#816 (comment) . You might want to have whole respose signed due reasons linked to previous answer but it is up to you to decide what to do regarding security of your system.

In order to spot how AzureAD (your AzureAD intance) is configured see auth response and use one of the links provided at answer #321 (comment) :

Here is (scoll down a bit this answer) node-saml/passport-saml#671 (reply in thread) sample how to spot from saml authn response how your IdP is configured at the moment and after that you have possibility to change your SP side configuration, reconfigure IdP side etc...

FedeFressiel · 2023-08-25T17:23:55Z

FedeFressiel
Aug 25, 2023
Author

Hello guys, sorry to keep bothering you but I am a bit lost.
When I run the test from the SSO test page

I still get the error. I don't even know how to fill the "validate response" fields from https://www.samltool.com/

I am trying to copy this without any luck.
https://www.youtube.com/watch?v=CUcKiO7NB-s
Is there any way to make the validation more verbose?

7 replies

srd90 Aug 25, 2023

...fail to understand what you're asking for.

I was asking two things:

what version of @node-saml/node-saml you are using
content which was processed by validatePostResponseAsync function. I.e. content of HTTP POST request that azure ad triggered after you authenticated at Azure side and it forwarded you to your application. You obviously already have it in clear text (because you feeded it into samltool).

Because still not seen that content (so that you would have removed sensitive information i.e. replacing e.g. nameid value with "XXX" and other sensitive stuff similar way) we can't say how your IdP is being configured at the moment (i.e. what parts of that document it signs...which was important information few hours ago but now you have configured your stack to be happy if response or assertion is signed).

But since samltool said (and I am assuming that you used this https://www.samltool.com/validate_response.php ) that it failed to validate signature it means that you have incorrect IdP certificate when you try to validate response or you altered response somehow (so that canonicalization does not "fix" it anymore) before you pasted it to saml tool and since it said invalid issuer it means that IdP entity ID field value didn't match with issuer field. I have hard time believing that azure would sign authentication response and/or assertion with incorrect key.

This would have been / could be little bit easier if we could see what you see i.e. content of this xml field:

node-saml/src/saml.ts

Line 675 in f35191d

xml = Buffer.from(container.SAMLResponse, "base64").toString("utf8");

(but do remove your personal information from it before you post it ... replace with e.g. "XXX").

csemeria Aug 25, 2023

Thanks for the reply, first thing first: @node-saml/node-saml": "^4.0.5"

Response in XML format:

  <samlp:Response ID="_d34e5e00-409d-4928-b547-bcc2fa3130dc" Version="2.0" IssueInstant="2023-08-25T21:00:07.443Z"
                Destination="http://localhost:9000/ssocallback" InResponseTo="_b03a79a6f7633ca5e5bd007fdae525fc2353038b"
                xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
        https://sts.windows.net/d34ee389-603b-4378-9864-d6c3f320eddc/
    </Issuer>
    <samlp:Status>
        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </samlp:Status>
    <Assertion ID="_24900366-8d28-4e26-ab1b-06c4ca961700" IssueInstant="2023-08-25T21:00:07.437Z" Version="2.0"
               xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
        <Issuer>https://sts.windows.net/d34ee389-603b-4378-9864-d6c3f320eddc/</Issuer>
        <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
            <SignedInfo>
                <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
                <Reference URI="#_24900366-8d28-4e26-ab1b-06c4ca961700">
                    <Transforms>
                        <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                        <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    </Transforms>
                    <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                    <DigestValue>W04MkvkgPF91oxUn5aN6NILZxsYIMH0ghiY4A0ujAP8=</DigestValue>
                </Reference>
            </SignedInfo>
            <SignatureValue>
                RJX25...
            </SignatureValue>
            <KeyInfo>
                <X509Data>
                    <X509Certificate>
                        MIIC8...
                    </X509Certificate>
                </X509Data>
            </KeyInfo>
        </Signature>
        <Subject>
            <NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">XXXX</NameID>
            <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <SubjectConfirmationData InResponseTo="_b03a79a6f7633ca5e5bd007fdae525fc2353038b"
                                         NotOnOrAfter="2023-08-25T22:00:07.335Z"
                                         Recipient="http://localhost:9000/ssocallback"/>
            </SubjectConfirmation>
        </Subject>
        <Conditions NotBefore="2023-08-25T20:55:07.335Z" NotOnOrAfter="2023-08-25T22:00:07.335Z">
            <AudienceRestriction>
                <Audience>http://localhost:3000</Audience>
            </AudienceRestriction>
        </Conditions>
        <AttributeStatement>
            <Attribute Name="http://schemas.microsoft.com/identity/claims/tenantid">
                <AttributeValue>XXXX</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.microsoft.com/identity/claims/objectidentifier">
                <AttributeValue>XXXX</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.microsoft.com/identity/claims/displayname">
                <AttributeValue>XXXX</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.microsoft.com/identity/claims/identityprovider">
                <AttributeValue>https://sts.windows.net/XXXX/</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.microsoft.com/claims/authnmethodsreferences">
                <AttributeValue>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</AttributeValue>
                <AttributeValue>http://schemas.microsoft.com/claims/multipleauthn</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname">
                <AttributeValue>Dev</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname">
                <AttributeValue>XXXXAttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
                <AttributeValue>XXXX</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name">
                <AttributeValue>XXXX</AttributeValue>
            </Attribute>
        </AttributeStatement>
        <AuthnStatement AuthnInstant="2023-08-25T16:24:41.907Z" SessionIndex="XXXX">
            <AuthnContext>
                <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
                </AuthnContextClassRef>
            </AuthnContext>
        </AuthnStatement>
    </Assertion>
</samlp:Response>

I am assuming that you used this https://www.samltool.com/validate_response.php

Yes, I did that

I'm quite sure I didn't alter the response, not so sure about having filled the IdP EntityId and SP EntityId properly (I used the "issuer" param sent in the request to azure in both) I also tried sending there and I got an additional error when doing it on SP: " is not a valid audience for this Response" but not changes when doing it on IdP.

Again, any help is more than welcomed (i wouldn't complain about an aspirin either :P)

csemeria Aug 25, 2023

This would have been / could be little bit easier if we could see what you see i.e. content of this xml field:

node-saml/src/saml.ts

Line 675 in [f35191d](https://github.com/node-saml/node-saml/commit/f35191dd532301a6b1802ba40396ee9d7fe203df)
 xml = Buffer.from(container.SAMLResponse, "base64").toString("utf8");

<samlp:Response ID="_c62763f7-076b-4c4b-af3c-f1e3c5b1f890" Version="2.0" IssueInstant="2023-08-25T22:42:08.421Z"
                Destination="http://localhost:9000/ssocallback" InResponseTo="_9a397633271543a09ef580b51e8ca2cbf0931e0f"
                xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
        https://sts.windows.net/XXXX/
    </Issuer>
    <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
        <SignedInfo>
            <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
            <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
            <Reference URI="#_c62763f7-076b-4c4b-af3c-f1e3c5b1f890">
                <Transforms>
                    <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                    <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                </Transforms>
                <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                <DigestValue>XXXX</DigestValue>
            </Reference>
        </SignedInfo>
        <SignatureValue>
            n9O1...
        </SignatureValue>
        <KeyInfo>
            <ds:X509Data xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <ds:X509Certificate>
                    MIIC8...
                </ds:X509Certificate>
            </ds:X509Data>
        </KeyInfo>
    </Signature>
    <samlp:Status>
        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </samlp:Status>
    <Assertion ID="_XXXX IssueInstant="2023-08-25T22:42:08.420Z" Version="2.0"
               xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
        <Issuer>https://sts.windows.net/XXXX/</Issuer>
        <Subject>
            <NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">dev@cybercloudnetworks.com</NameID>
            <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <SubjectConfirmationData InResponseTo="_XXXX"
                                         NotOnOrAfter="2023-08-25T23:42:08.321Z"
                                         Recipient="http://localhost:9000/ssocallback"/>
            </SubjectConfirmation>
        </Subject>
        <Conditions NotBefore="2023-08-25T22:37:08.321Z" NotOnOrAfter="2023-08-25T23:42:08.321Z">
            <AudienceRestriction>
                <Audience>http://localhost:3000</Audience>
            </AudienceRestriction>
        </Conditions>
        <AttributeStatement>
            <Attribute Name="http://schemas.microsoft.com/identity/claims/tenantid">
                <AttributeValue>XXXX</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.microsoft.com/identity/claims/objectidentifier">
                <AttributeValue>XXXX</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.microsoft.com/identity/claims/displayname">
                <AttributeValue>XXXX</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.microsoft.com/identity/claims/identityprovider">
                <AttributeValue>https://sts.windows.net/XXXX/</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.microsoft.com/claims/authnmethodsreferences">
                <AttributeValue>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</AttributeValue>
                <AttributeValue>http://schemas.microsoft.com/claims/multipleauthn</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname">
                <AttributeValue>XXXX</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname">
                <AttributeValue>XXXX</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
                <AttributeValue>XXXX</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name">
                <AttributeValue>XXXX</AttributeValue>
            </Attribute>
        </AttributeStatement>
        <AuthnStatement AuthnInstant="2023-08-25T16:24:41.907Z" SessionIndex="_XXXX">
            <AuthnContext>
                <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
                </AuthnContextClassRef>
            </AuthnContext>
        </AuthnStatement>
    </Assertion>
</samlp:Response>

srd90 Aug 25, 2023

First of all:
Based on this SAML response: #321 (reply in thread)

 <samlp:Response ID="_d34e5e00-409d-4928-b547-bcc2fa3130dc" ...>
...
   <Assertion ID="_24900366-8d28-4e26-ab1b-06c4ca961700" ...>
...
       <Signature ...>
           <SignedInfo>
...
               <Reference URI="#_24900366-8d28-4e26-ab1b-06c4ca961700">
...
               </Reference>
           </SignedInfo>
...
       </Signature>
...
   </Assertion>
</samlp:Response>

It seems that it has unsigned response and signed assertion.

When this discussion started and IF you had that same configuration at azure side then problem was that you used default configuration at @node-saml/node-saml side. Default configuration (i.e. configuration which is effective if you haven't configured anything else) is this:

wantAuthnResponseSigned: true,
wantAssertionsSigned: true

and because Azure signed only Assertion @node-saml/node-saml ended up reporting that document signature checking failed (because wantAuthnResponseSigned: true and there wasn't such signature at all, i.e. it stopped there).

This would be correct configuration in this particular case:

wantAuthnResponseSigned: false,
wantAssertionsSigned: true

Once you sort things out with signature validation (i.e. find certificate that matches with key that was used to signature) you might proceed to change your azure configuration (if possible) so that it signs response in order to have extra layer of security (see links from earlier response for additional information).

Based on this SAML response: #321 (reply in thread)
...did you just alter azure side configuration???? because that message has signed response and unsigned assertion.

<samlp:Response ID="_c62763f7-076b-4c4b-af3c-f1e3c5b1f890" ...>
...
   <Signature ...>
       <SignedInfo>
...
           <Reference URI="#_c62763f7-076b-4c4b-af3c-f1e3c5b1f890">
...
           </Reference>
       </SignedInfo>
...
   </Signature>
...
   <Assertion ID="_XXXX ....>
...
   </Assertion>
</samlp:Response>

in this case proper @node-saml/node-saml side configuration for want* values would be

wantAuthnResponseSigned: true,
wantAssertionsSigned: false

It usually helps if you do not change everything all the time and concentrate to one thing....

But back to your current problem which is between you, azure and samltool :)

Try to paste to https://www.samltool.com/validate_response.php a base64 encoded version of message (i.e. prior it is base64 decoded). It accepts also base64 encoded content. This way you can be sure that you haven't altered content during copy pasting etc. I.e. take content of container.SAMLResponse and paste it to samltool.

...not so sure about having filled the IdP EntityId and SP EntityId properly (I used the "issuer" param sent in the request to azure in both)

When you handle message from IdP (in this case <Response/>) issuer is IdP not SP. When you send authentication request from SP to IdP issuer is SP.

So far it seems that at the end of the day you don't have proper IdP certificate or you keep changing everything with such a speed that your configuration and downloaded certificates you use doesn't match anymore.

So...freeze your azure side configuration and spend some time with samltool (as long as it take to have IdP ceritificate that matches with key that azure used to sign your response and/or assertion) and after that proceed to @node-saml/node-saml.

csemeria Aug 26, 2023

Thanks again for the answer, as you can guess we tried every combination between azure and client confs. I was quite tired yesterday so it may be that the first xml was taken from an earlier run (already decoded and beautified), then I re read you and because I still was with the debugging on, I tooked at the xml from xml = Buffer.from(container.SAMLResponse, "base64").toString("utf8"); and copied it for you in the second comment.

The issue is solved now. We changed server conf to sign both, we matched local options conf and we downloaded a fresh certificate.
May It be the problem server conf impact in the certificate? Because otherwise I now don't know why now is working and sooner it failed.
My best guess is we started with a mismatch between local options and server conf, we fixed server conf but may be then we should have downloaded a new certificate and we didn't

In any case, thanks a lot for your help. It's highly appreciated.
Regards

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Invalid Signature #321

{{title}}

Replies: 4 comments 8 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

Invalid Signature #321

Replies: 4 comments · 8 replies

markstos Aug 24, 2023 Maintainer

FedeFressiel Aug 25, 2023 Author

FedeFressiel Aug 25, 2023 Author

Replies: 4 comments 8 replies

markstos
Aug 24, 2023
Maintainer

FedeFressiel
Aug 25, 2023
Author

FedeFressiel
Aug 25, 2023
Author