title: Validating a SAML to authenticate a user
body: <p>I have been trying the get a SAML authentication to work for quite some time now and am unable to validate the SAML message.
  Am I misunderstanding the whole process and should be and doing the whole thing differently?</p>
  <p>I have been trying to use <a href="https://github.com/XML-Security/signxml" rel="nofollow noreferrer">SignXML</a> but if anyone can provide an implementation using other packages that is fine.</p>
  <p>A <a href="https://github.com/XML-Security/signxml/blob/develop/signxml/__init__.py#L691" rel="nofollow noreferrer">link to the verification method</a> and <a href="https://signxml.readthedocs.io/_/downloads/en/latest/pdf/" rel="nofollow noreferrer">the docs</a>.</p>
  <h3>Short summary of the process:</h3>
  <p>I login on a third party service that then redirects me to my website with a SAML token. The SAML is verified and I am logged in based on the information in the SAML.
  The third party service has provided me with a cert chain(2 cer file) that I use to verify the integrity of the SAML received.</p>
  <h2>A simplified version of the code I wrote:</h2>
  <pre><code>xml_as_bytes = b64decode(token)
  saml = ET.fromstring(xml_as_bytes)
  trusted_cert_path = 'path to a .cer file containing two keys supplied by the creator of the SAML'
  XMLVerifier().verify(data=saml, ca_pem_file=trusted_cert_path)
  </code></pre>
  <p>Throws the following error:</p>
  <pre><code>XMLVerifier().verify(data=saml, ca_pem_file=trusted_cert_path)
    File &quot;/usr/local/lib/python3.9/site-packages/signxml/__init__.py&quot;, line 864, in verify
      verify(signing_cert, raw_signature, signed_info_c14n, signature_digest_method)
  signxml.exceptions.InvalidSignature: Signature verification failed: bad signature
  </code></pre>
  <p>I have tried splitting the files up in two and passing them in with the ca_path param, but gives me the following error.
  Also tried them individually with the same error result.</p>
  <pre><code>InvalidCertificate(X509StoreContextError([20, 0, 'unable to get local issuer certificate']))
  </code></pre>
  <h2>The SAML response with information redacted to show layout of response.</h2>
  <pre><code>&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;
  &lt;Response xmlns=&quot;urn:oasis:names:tc:SAML:2.0:protocol&quot; xmlns:xsd=&quot;http://www.w3.org/2001/XMLSchema&quot; xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot; ID=&quot;_15dcf5e1-495b-4dc3-98ac-874c8c7b7683&quot; Version=&quot;2.0&quot; IssueInstant=&quot;2021-08-24T13:16:20.6881029Z&quot; Destination=&quot;https://my.website.test/login/&quot;&gt;
     &lt;Issuer xmlns=&quot;urn:oasis:names:tc:SAML:2.0:assertion&quot;&gt;Innskraning&lt;/Issuer&gt;
     &lt;Signature xmlns=&quot;http://www.w3.org/2000/09/xmldsig#&quot;&gt;
        &lt;SignedInfo&gt;
           &lt;CanonicalizationMethod Algorithm=&quot;http://www.w3.org/TR/2001/REC-xml-c14n-20010315&quot; /&gt;
           &lt;SignatureMethod Algorithm=&quot;http://www.w3.org/2000/09/xmldsig#rsa-sha1&quot; /&gt;
           &lt;Reference URI=&quot;&quot;&gt;
              &lt;Transforms&gt;
                 &lt;Transform Algorithm=&quot;http://www.w3.org/2000/09/xmldsig#enveloped-signature&quot; /&gt;
                 &lt;Transform Algorithm=&quot;http://www.w3.org/2001/10/xml-exc-c14n#&quot; /&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm=&quot;http://www.w3.org/2001/04/xmlenc#sha256&quot; /&gt;
              &lt;DigestValue&gt;base64 digetst value&lt;/DigestValue&gt;
           &lt;/Reference&gt;
        &lt;/SignedInfo&gt;
        &lt;SignatureValue&gt;base64 signature value&lt;/SignatureValue&gt;
        &lt;KeyInfo&gt;
           &lt;X509Data&gt;
              &lt;X509Certificate&gt;base64 certificate&lt;/X509Certificate&gt;
           &lt;/X509Data&gt;
        &lt;/KeyInfo&gt;
     &lt;/Signature&gt;
     &lt;Status&gt;
        &lt;StatusCode Value=&quot;urn:oasis:names:tc:SAML:2.0:status:Success&quot; /&gt;
     &lt;/Status&gt;
     &lt;Assertion xmlns=&quot;urn:oasis:names:tc:SAML:2.0:assertion&quot; Version=&quot;2.0&quot; ID=&quot;_acd5ee05-3f60-4595-a7f8-1dae1c2baf70&quot; IssueInstant=&quot;2021-08-24T13:16:20.6881029Z&quot;&gt;
        &lt;Issuer&gt;Innskraning&lt;/Issuer&gt;
        &lt;Subject&gt;
           &lt;NameID NameQualifier=&quot;issuer-website.test&quot; /&gt;
           &lt;SubjectConfirmation Method=&quot;urn:oasis:names:tc:SAML:2.0:cm:bearer&quot;&gt;
              &lt;SubjectConfirmationData Address=&quot;127.0.0.1&quot; NotOnOrAfter=&quot;2021-08-24T13:21:20.6881029Z&quot; Recipient=&quot;https://my.website.test/login/&quot; /&gt;
           &lt;/SubjectConfirmation&gt;
        &lt;/Subject&gt;
        &lt;Conditions NotBefore=&quot;2021-08-24T13:15:50.6881029Z&quot; NotOnOrAfter=&quot;2021-08-24T13:21:20.6881029Z&quot;&gt;
           &lt;AudienceRestriction&gt;
              &lt;Audience&gt;my.website.test&lt;/Audience&gt;
           &lt;/AudienceRestriction&gt;
        &lt;/Conditions&gt;
        &lt;AuthnStatement AuthnInstant=&quot;2021-08-24T13:16:20.6881029Z&quot;&gt;
           &lt;SubjectLocality Address=&quot;127.0.0.1&quot; /&gt;
           &lt;AuthnContext&gt;
              &lt;AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient&lt;/AuthnContextClassRef&gt;
           &lt;/AuthnContext&gt;
        &lt;/AuthnStatement&gt;
        &lt;AttributeStatement&gt;
           &lt;Attribute Name=&quot;UserSSN&quot; NameFormat=&quot;urn:oasis:names:tc:SAML:2.0:attrname-format:basic&quot; FriendlyName=&quot;Kennitala&quot;&gt;
              &lt;AttributeValue xsi:type=&quot;xsd:string&quot;&gt;1234567890&lt;/AttributeValue&gt;
           &lt;/Attribute&gt;
        &lt;/AttributeStatement&gt;
     &lt;/Assertion&gt;
  &lt;/Response&gt;
  </code></pre>