topic Re: Verification of SAML assertion using cert failed in Security

Verification of SAML assertion using cert failed

splunkgk — Wed, 17 May 2017 07:07:46 GMT

I have configured SAML SSO with Onelogin. My splunk app http://:8000/ is redirecting succusfully to Assertion consumer URL but getting an error message on spunk login page which does not allowing me to login with onelogn credentials

"Verification of SAML assertion using the IDP's certificate provided failed. Error: Failed to verify signature with cert :/opt/splunk/etc/auth/idpCerts/idpCert.pem;"

I have copied IdPCert.pem in required path /etc/auth/IdPCerts/

Does any one know who do i fix this?

-Thanks

Re: Verification of SAML assertion using cert failed

raomu — Wed, 14 Feb 2018 05:46:14 GMT

I am facing the same issue wondering if you got this resolved ? if yes? please share some tips.

Re: Verification of SAML assertion using cert failed

suarezry — Tue, 01 May 2018 14:52:22 GMT

Please post your $SPLUNK_HOME/etc/system/local/authentication.conf

Re: Verification of SAML assertion using cert failed

raomu — Wed, 02 May 2018 03:59:09 GMT

You need to generate the Cert file information from Onelogin. Then paste the same cert information under -IdP certificate chains box under "Configure Splunk to use SAML" .

Re: Verification of SAML assertion using cert failed

stsamson005 — Fri, 23 Nov 2018 21:10:27 GMT

How do you generate the Cert file from onelogin?

Re: Verification of SAML assertion using cert failed

shwetas — Thu, 19 Dec 2019 04:31:17 GMT

HI All,

Would like to clarify for SAML do we have to bring separate istance for configuration,OR just ADFS server and Splunk configured with SAML will do.

I am totally confuse from documentation.Any help with respect to enabling SSO in splunk will help.

Regards,
Shweta

Re: Verification of SAML assertion using cert failed

worshamn — Wed, 30 Sep 2020 03:25:08 GMT

I have had this issue where one of the certs had expired. In $SPLUNK_HOME/etc/auth/idpCerts, splunk creates a folder called idpCertChain_1 where it breaks apart the cert you pasted (IdP certificate chains--these are the signing certs from your SSO provider--this can often be found in a metadata file from the provider or sometimes they just outright have a way for you to download it) from the setup into various certs and calls them cert_1.pem, cert_2.pem, ... etc. cert_1.pem is the root CA, cert_2.pem would be an issuing CA if applicable--if not would be the main cert from the IdP (fancy name for single sign on provider). You can check the certs out using $SPLUNK_HOME/bin/splunk cmd openssl x509 -noout -text -in cert_1.pem to see when it expires, adding -endate will print that line last like so:

$SPLUNK_HOME/bin/splunk cmd openssl x509 -noout -text -in $SPLUNK_HOME/etc/auth/idpCerts/idpCertChain_1/cert_1.pem -enddate

Updating the cert with one that was not expired fixed the issue in my case.