SSO SAML assertion validation failed: signature mismatch

The SAML certificate configured in ServiceNow does not match the certificate used by the identity provider to sign assertions, or the certificate has expired. (high likelihood)

Clock synchronization issues between ServiceNow and the identity provider causing timestamp validation failures during signature verification. (high likelihood)

The identity provider configuration has changed its signing algorithm or certificate without updating the corresponding configuration in ServiceNow. (medium likelihood)

Incorrect audience or entity ID configuration in the identity provider that doesn't match the ServiceNow instance URL or specified audience value. (medium likelihood)

Network intermediaries or proxies are modifying the SAML response in transit, corrupting the signature validation process. (low likelihood)

Step 1: Navigate to System SSO > Identity Providers and locate the affected SAML configuration to review the current certificate and settings.

Step 2: Check the System Log at System Diagnostics > Log > Application Log for additional SAML-related error details that may indicate specific validation failures.

Step 3: Verify the SAML certificate in the Identity Provider record matches the current certificate used by your IdP by comparing the certificate fingerprints or expiration dates.

Step 4: Update the certificate in the Identity Provider record if it has expired or changed, ensuring you paste the complete certificate including BEGIN and END certificate markers.

Step 5: Check the clock synchronization between your ServiceNow instance and identity provider servers, ensuring time drift is less than 5 minutes.

Step 6: Verify the Entity ID and ACS URL in your identity provider configuration match exactly with the values shown in the ServiceNow Identity Provider record.

Step 7: Test the SAML authentication using the Test Connection feature in the Identity Provider record to validate the signature verification is now working.

Step 8: Enable SAML debug logging by setting the log level for com.snc.integration.sso to Debug in System Diagnostics > Log Levels for detailed troubleshooting if issues persist.