I'm attempting to implement SSO for a salesforce sandbox Community instance with a custom Rails app as the IdP, and no matter how I format the SAML Assertion after login I'm redirected to the error page with no error code in the URL.
On the SAML Validator page I get:
11. Validating the Signature
Is the response signed? false
Is the assertion signed? true
The reference in the assertion signature is valid
Is the correct certificate supplied in the keyinfo? true
Signature or certificate problems
The signature in the assertion is not valid
Everything else is green, and the subject is found via the FederationID.
I'm using this gem (customized to fit the SAML examples from the Salesforce Single Sign On docs as closely as possible) and its default certificate and secret key:
https://github.com/lawrencepit/ruby-saml-idp
You can see how it's doing the signing here on line 88:
https://github.com/lawrencepit/ruby-saml-idp/blob/master/lib/saml_idp/controller.rb
...the algorithm used is SHA1.
Any idea what might be causing the incorrect signature error?
An example SAML response is below:
<?xml version="1.0" encoding="UTF-8"?>
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="_9f7f2f60-881a-0134-5879-14109fe1c093" Version="2.0" IssueInstant="2016-11-08T19:51:11Z" Destination="https://full-[redacted].cs2.force.com/[redacted]customers/login?so=00DR0000001yqNj" Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified">
<Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">http://2f5fdc55.ngrok.io/saml/auth</Issuer>
<samlp:Status>
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
</samlp:Status>
<Assertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="_9f7f3050-881a-0134-5879-14109fe1c093" IssueInstant="2016-11-08T19:51:11Z" Version="2.0">
<Issuer>http://2f5fdc55.ngrok.io/saml/auth</Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
<ds:Reference URI="#_9f7f3050-881a-0134-5879-14109fe1c093">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<ds:DigestValue>nMivGNZKL8W+5/Mec9racVJWMgA=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>S405EwCezDM4mo672fd+dJNOGRoHPZ5CmyfDF00AuUA0Bp7nDkphdqaDsfwc+bJksp6PjEmYz7pdQtaUSky38FulGz6JphsSPrQiTV+qFhrsjmPqsUHp6ni3+QVdgrUlAHTSqP+S+j4Wzdd9oKG8dNFXQfBcT3sdGjWq/diDjfw=</ds:SignatureValue>
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF5T0RBeU1qSXlPRm9YRFRNeU1EUXkKTXpBeU1qSXlPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXVCeXdQTmxDMUZvcEdMWWZGOTZTb3RpSwo4Tmo2L25XMDg0TzRvbVJNaWZ6eTd4OTU1UkxFeTY3M3EyYWlKTkIzTHZFNlh2a3Q5Y0d0eHROb09YdzFnMlV2CkhLcGxkUWJyNmJPRWpMTmVETlc3ajBvYitKclJ2QVVPSzlDUmdkeXc1TUM2bHdxVlFRNUMxRG5hVC8yZlNCRmoKYXNCRlRSMjRkRXBmVHk4SGZLRUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJRTkJHbW10M3l0S3BjSmFCYVlOYm55VTJ4a2F6QVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVEUVJwcHJkOHJTcVhDV2dXbURXNThsTnNaR3VoZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FBRQpjVlVQQlg3dVptenFaSmZ5K3RVUE9UNUltTlFqOFZFMmxlcmhuRmpuR1BIbUhJcWhwemdud0hRdWpKZnMvYTMwCjlXbTVxd2NDYUMxZU81Y1dqY0cweDNPamRsbHNnWURhdGw1R0F1bXRCeDhKM05oV1JxTlVnaXRDSWtRbHhISXcKVWZnUWFDdXNoWWdEREw1WWJJUWErK2VnQ2dwSVorVDBEajVvUmV3Ly9BPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
</ds:X509Data>
</KeyInfo>
</ds:Signature>
<Subject>
<NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">[redacted]@[redacted].com</NameID>
<SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<SubjectConfirmationData NotOnOrAfter="2016-11-08T19:54:11Z" Recipient="https://full-[redacted].cs2.force.com/[redacted]customers/login?so=00DR0000001yqNj" />
</SubjectConfirmation>
</Subject>
<Conditions NotBefore="2016-11-08T19:51:06Z" NotOnOrAfter="2016-11-08T20:51:11Z">
<AudienceRestriction>
<Audience>https://full-[redacted].cs2.force.com/</Audience>
</AudienceRestriction>
</Conditions>
<AttributeStatement>
<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
<AttributeValue>[redacted]@[redacted].com</AttributeValue>
</Attribute>
<Attribute Name="User.ProfileID" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<AttributeValue type="anyType">00e15000001Iomk</AttributeValue>
</Attribute>
</AttributeStatement>
<AuthnStatement AuthnInstant="2016-11-08T19:51:11Z" SessionIndex="_9f7f3050-881a-0134-5879-14109fe1c093">
<AuthnContext>
<AuthnContextClassRef>urn:federation:authentication:windows</AuthnContextClassRef>
</AuthnContext>
</AuthnStatement>
</Assertion>
</samlp:Response>
SAML Single Sign-On Settings:
Name: developer.[redacted].com
SSO API Name: developer_[redacted]_com_SSO2
SAML Version: 2.0
Issuer: http://[redacted].ngrok.io/saml/auth
Entity ID: https://[redacted].cs2.force.com/
Identity Provider Certificate EM[email protected], CN=lawrencepit.com, OU=, O=PIT, L=Sydney, ST=NSW, C=AU
Expiration: 23 Apr 2032 02:22:28 GMT
Request Signing Certificate: Default Certificate
Request Signature Method: RSA-SHA1
Assertion Decryption Certificate: Assertion not encrypted
SAML Identity Type: Federation ID
SAML Identity Location: Subject
Identity Provider Login URL: http://[redacted].ngrok.io/saml/auth
Identity Provider Logout URL:
Custom Error URL: http://[redacted].ngrok.io/saml/error
Just-in-time User Provisioning:
User Provisioning Enabled: Not Checked
Endpoints:
Salesforce Login URL: https://test.salesforce.com?so=00DR0000001yqNj
Customer Community Community Login URL: https://[redacted].cs2.force.com/[redacted]customers/login?so=00DR0000001yqNj
OAuth 2.0 Token Endpoint: https://test.salesforce.com/services/oauth2/token?so=00DR0000001yqNj