SAML Connection Stops Working

An existing SAML connection through which users could successfully log in stopped working for all (Service Provider (SP)-Initiated) user login attempts. There were no recent configuration changes either on the Auth0 connection settings or on the IdP configuration side.

• Starting a login attempt through the SAML connection (SP-Initiated with signed authentication request) results in an error and a failed login (`type:f`) tenant log is created in the tenant.
• The failed login tenant log includes an error message referring to issues associated with an invalid signature and/or issues related to the validation of the authentication request. A SAML response will also be present within the tenant log.

If the response can be decoded, verify whether a Status element is included within the response. If that element exists and contains within it an element StatusMessage containing the exact same text message as the error message. In this case, it is confirmed that the error itself originates from the upstream Identity Provider (IdP) and not from Auth0 itself, which in the scope of issues associated with signature validation, means that the problem is not with Auth0 verifying the SAML response, but most likely related to the IdP trying to validate the signed SAML authentication request that Auth0 sent.

Having confirmed that the signature and certificate error originates from the IdP, the next step is to confirm which certificate or keys are used by the connection to sign outgoing authentication requests. View the connection configuration in Inspector and confirm if the connection has the options.signing_key attribute set this means the connection uses a custom certificate provided by a tenant admin instead of the default tenant signing key for SAML connections.

Given that the connection stopped working without any apparent changes, it is likely that the IdP is already set up to use the public key corresponding to this custom certificate. Use the certificate with the public key from options.signing_key.cert`\ and parse it to verify the validity period and confirm if the certificate may have expired around the same time the errors started.

• SAML Connections

The custom certificate configured in the connection for authentication request signing expired, and the upstream IdP requires the certificate to be valid (within its validity period).

Also, a private key configured as PKCS#1 was in use. The PKCS#8 format should be used, as well as with the decryption_key

Renew the certificate in question through a certification authority. After obtaining a new certificate, update the SAML connection to use it (Use a custom key to sign requests) and provide the public key to the upstream IdP so that they also update their configuration to use the new certificate.