topic Splunk Phantom SAML SAML2 authentication error Signature missing for response in Splunk SOAR

Splunk Phantom SAML SAML2 authentication error Signature missing for response

eugeneAq — Tue, 15 Jun 2021 01:25:44 GMT

We were configuring our phantom instance for saml sso login and we are encountering the following error.

SAML2 authentication error

Signature missing for response

We have already configured every field here.
Are we missing anything? Would we need to configure the idp chains or certficates.

Re: Splunk Phantom SAML SAML2 authentication error Signature missing for response

sam_splunk — Wed, 16 Jun 2021 16:58:11 GMT

It sounds like your IdP is not signing the assertion. You'll want to want to ensure that is occuring. You can install a browser plugin like SAML-TRACER to view the assertions as they make their way to Phantom to ensure the signature is present.

While it may not be your IDP - https://github.com/phantomcyber/phantom-community-projects/blob/master/Questions/SSO/SAML/PingFederate/PingFederate10.md has some details of setting up SSO with SAML (that doc is PingFederate specifically).

Re: Splunk Phantom SAML SAML2 authentication error Signature missing for response

ramanpuri2510 — Fri, 13 Aug 2021 03:57:25 GMT

Hi I am doing OKTA SAML integration with Phantom and getting the below error.

SAML2 Authentication Error'NoneType' object has no attribute 'require_signature

Can i know if any option to make the AuthnRequestsSigned="true to false? or any other suggestions.. I have tried disabling the signing on both okta and phantom