# Auth Error

**URL:** <https://community.sonatype.com/t/auth-error/16633>\
**Category:** Sonatype Lifecycle & Firewall\
**Created:** [September 14, 2026, 3:43pm UTC](https://community.sonatype.com/t/auth-error/16633 "2026-09-14T15:43:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jonathan.solan](https://avatars.discourse-cdn.com/v4/letter/j/e68b1a/32.png) [@jonathan.solan](https://community.sonatype.com/u/jonathan.solan)\
**Post date:** [September 14, 2026, 3:43pm UTC](https://community.sonatype.com/t/auth-error/16633/1 "2026-09-14T15:43:46Z")

</div>

In version 207.1, I encounter the following error when logging in via SAML. The certificate has been updated on the Entra ID side and re-imported.  
When the “Validate Response Signature” setting is set to False, I am able to log in successfully.

Authentication failed due to SAML error. Please contact your IT administrator.

![image](https://canada1.discourse-cdn.com/flex047/uploads/communitysonatype/original/2X/f/f25c07cf7ca0befb5c6eb9454e506d601c8255db.png)

![image](https://canada1.discourse-cdn.com/flex047/uploads/communitysonatype/original/2X/f/f68406921347d8f64c29f8b0139119b413965788.png)

---

<div class="post-metadata">

**Author:** ![jzora](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/jzora/32/4197_2.png) [@jzora](https://community.sonatype.com/u/jzora)\
**Post date:** [September 14, 2026, 7:57pm UTC](https://community.sonatype.com/t/auth-error/16633/2 "2026-09-14T19:57:31Z")

</div>

Hi, Jonathan. I believe this was an was an intentional change made in 207/207.1. Configure your IdP to sign both the SAML response _and_ assertion, with both signature validation options enabled in IQ Server, and that should resolve the issue.

I’m currently waiting for a note to be added to documentation to this effect. I’ll alert you when that change is made.

---

<div class="post-metadata">

**Author:** ![jonathan.solan](https://avatars.discourse-cdn.com/v4/letter/j/e68b1a/32.png) [@jonathan.solan](https://community.sonatype.com/u/jonathan.solan)\
**Post date:** [September 16, 2026, 1:51pm UTC](https://community.sonatype.com/t/auth-error/16633/3 "2026-09-16T13:51:15Z")

</div>

Thanks, Jonathan. Do you have the information available? That way, I can share it internally with the team and sort out the chaos.

---

<div class="post-metadata">

**Author:** ![jzora](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/jzora/32/4197_2.png) [@jzora](https://community.sonatype.com/u/jzora)\
**Post date:** [September 16, 2026, 3:16pm UTC](https://community.sonatype.com/t/auth-error/16633/4 "2026-09-16T15:16:10Z")

</div>

Here’s what I know:

IQ 207 enforces stricter, per-element SAML response-signature validation. One fix is to change _Validate Response Signature_ to False, but another fix is to ensure the samlp:Response element itself carries a signature. This change improves IQ Server’s security posture, so it’s not a bug.

If you need more details or a thorough walkthrough, I’d open a support ticket.

Either way, as soon as I see this advice reflected in documentation, I’ll ping you!