Identity Platform - SAML - Signing requests

[vitolo]

Hello,

i've enabled Signed Request option on a saml authentication managed by identity platform. Docs about this feature is here: https://cloud.google.com/identity-platform/docs/web/saml#signing_requests 

After enabling it, the payload of authentication request correctly contains two more params: SigAlg: http://www.w3.org/2000/09/xmldsig#rsa-sha1
and
Signature: HzlyeADFBfptu44...

During the activation process, as described by docs, google returns an X509Certificate.

"spCertificates": [
      {
        "x509Certificate": "-----BEGIN CERTIFICATE-----\nMIIDMDCCAhigAw.....-----END CERTIFICATE-----\n",
        "expiresAt": "2028-08-29T17:23:48.626Z"
      }
]

The problem is that Signature verification with the X509Certificate always fails!

Do you have any suggestion?

thanks, vittorio

[robertcarlos]

Hi @vitolo,

Welcome to Google Cloud Community!

You may want to check the following links that could resolve the issue you're currently experiencing:

• Failed to verify the signature in SAMLResponse 
• Maintain SAML certificates 
• StatusPage cloud application 

If the aforementioned links didn't work out for you, you may want to file for a bug or contact Google Cloud support for additional help.

[vitolo]

Hi robertcarlos,
thanks for your reply.
However it doens't solve the issue because the problem regards "signed request" not response.
I'm talking about this setting: https://cloud.google.com/identity-platform/docs/web/saml#signing_requests 

Do you have any other suggestion?