In version 207.1, I encounter the following error when logging in via SAML. The certificate has been updated on the Entra ID side and re-imported.
When the “Validate Response Signature” setting is set to False, I am able to log in successfully.
Authentication failed due to SAML error. Please contact your IT administrator.
Hi, Jonathan. I believe this was an was an intentional change made in 207/207.1. Configure your IdP to sign both the SAML response and assertion, with both signature validation options enabled in IQ Server, and that should resolve the issue.
I’m currently waiting for a note to be added to documentation to this effect. I’ll alert you when that change is made.
Thanks, Jonathan. Do you have the information available? That way, I can share it internally with the team and sort out the chaos.
Here’s what I know:
IQ 207 enforces stricter, per-element SAML response-signature validation. One fix is to change Validate Response Signature to False, but another fix is to ensure the samlp:Response element itself carries a signature. This change improves IQ Server’s security posture, so it’s not a bug.
If you need more details or a thorough walkthrough, I’d open a support ticket.
Either way, as soon as I see this advice reflected in documentation, I’ll ping you!