title: Issuer of the Assertion not found or multiple. A valid SubjectConfirmation was not found
body: <p>I am generating unsigned SAML response with signed assertion for my IDP. When I am validating it using samltool.com, it fails with following errors: </p>
  
  <p>Issuer of the Assertion not found or multiple. 
  A valid SubjectConfirmation was not found on this Response Found an invalid Signed Element. SAML Response rejected.</p>
  
  <p>But when I generate Signed response with Unsigned assertion it passes without any error. I checked the overall XML is valid. I checked other posts but could find any answer. </p>
  
  <p>Any thoughts around this issue, would help. </p>
  
  <pre><code>    &lt;?xml version="1.0"?&gt;
  &lt;samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_c2658c71-1361-48c6-b733-c95858146230" Version="2.0" IssueInstant="2019-02-10T04:19:45.482Z" Destination="XXXXXXX" InResponseTo="samlrequest_25369109d2af475ebe51e0e94a95967a"&gt;
      &lt;saml:Issuer&gt;XXXXXXX&lt;/saml:Issuer&gt;
      &lt;samlp:Status&gt;
          &lt;samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/&gt;
      &lt;/samlp:Status&gt;
      &lt;saml:Assertion xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" ID="_3c6a8bfd-292a-473f-91b5-fac5352de06a" Version="2.0" IssueInstant="2019-02-10T04:19:45.482Z"&gt;
          &lt;saml:Issuer&gt;XXXXXXX&lt;/saml:Issuer&gt;
          &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;ds:SignedInfo&gt;
                  &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                  &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
                  &lt;ds:Reference URI="#_c2658c71-1361-48c6-b733-c95858146230"&gt;
                      &lt;ds:Transforms&gt;
                          &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/&gt;
                          &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                      &lt;/ds:Transforms&gt;
                      &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
                      &lt;ds:DigestValue&gt;AYG+ZKBzsXPfpq94EcgFsvRgFLg=&lt;/ds:DigestValue&gt;
                  &lt;/ds:Reference&gt;
              &lt;/ds:SignedInfo&gt;
              &lt;ds:SignatureValue&gt;XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX==&lt;/ds:SignatureValue&gt;
              &lt;ds:KeyInfo&gt;
                  &lt;ds:X509Data&gt;
                      &lt;ds:X509Certificate&gt;XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX==&lt;/ds:X509Certificate&gt;
                  &lt;/ds:X509Data&gt;
              &lt;/ds:KeyInfo&gt;
          &lt;/ds:Signature&gt;
          &lt;saml:Subject&gt;
              &lt;saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"&gt;XXXXX@XXXXXXXX.com&lt;/saml:NameID&gt;
              &lt;saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"&gt;
                  &lt;saml:SubjectConfirmationData NotOnOrAfter="2019-02-10T04:24:45.482Z" Recipient="XXXXXXX" InResponseTo="samlrequest_25369109d2af475ebe51e0e94a95967a"/&gt;
              &lt;/saml:SubjectConfirmation&gt;
          &lt;/saml:Subject&gt;
          &lt;saml:Conditions NotBefore="2019-02-10T04:19:45.482Z" NotOnOrAfter="2019-02-10T04:24:45.482Z"&gt;
              &lt;saml:AudienceRestriction&gt;
                  &lt;saml:Audience&gt;XXXXXXX&lt;/saml:Audience&gt;
              &lt;/saml:AudienceRestriction&gt;
          &lt;/saml:Conditions&gt;
          &lt;saml:AuthnStatement AuthnInstant="2019-02-10T04:19:45.482Z" SessionNotOnOrAfter="2019-02-10T04:24:45.482Z" SessionIndex="9cb0eb45-3a0c-4fcf-90b7-3fab83a855ac"&gt;
              &lt;saml:AuthnContext&gt;
                  &lt;saml:AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:Password&lt;/saml:AuthnContextClassRef&gt;
              &lt;/saml:AuthnContext&gt;
          &lt;/saml:AuthnStatement&gt;
          &lt;saml:AttributeStatement&gt;
              &lt;saml:Attribute Name="Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"&gt;
                  &lt;saml:AttributeValue xsi:type="xs:string"&gt;XXXXXXX&lt;/saml:AttributeValue&gt;
              &lt;/saml:Attribute&gt;
              &lt;saml:Attribute Name="Gender" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"&gt;
                  &lt;saml:AttributeValue xsi:type="xs:string"&gt;XXXXXXXXX&lt;/saml:AttributeValue&gt;
              &lt;/saml:Attribute&gt;
              &lt;saml:Attribute Name="FirstName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"&gt;
                  &lt;saml:AttributeValue xsi:type="xs:string"&gt;XXXXXX&lt;/saml:AttributeValue&gt;
              &lt;/saml:Attribute&gt;
              &lt;saml:Attribute Name="LastName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"&gt;
                  &lt;saml:AttributeValue xsi:type="xs:string"&gt;XXXXXXX&lt;/saml:AttributeValue&gt;
              &lt;/saml:Attribute&gt;
  
          &lt;/saml:AttributeStatement&gt;
      &lt;/saml:Assertion&gt;
  &lt;/samlp:Response&gt;
  </code></pre>