SAML Response XML is invalid: The SAML XSD requires the Signature element to be just after the Issuer element

[MrChrisRodriguez]

SAML response XML is invalid: The SAML XSD requires the Signature element to be just after the Issuer element

This is a duplicate of fusionauth-issues #1047. It seemed like it might be more appropriate here.

Description

The SAML response XML being generated by FusionAuth is invalid. The XSD requires that the Signature element appear immediately after the Issuer element. FusionAuth is not fulfilling this requirement, so some SPs aren't even processing the Response because it fails validation (Twilio, for example). Auth0 had this same issue back in 2017, as well.

Affects versions

v1.22.2

Steps to reproduce

Steps to reproduce the behavior:

1. Set up a SAML Application
2. Turn on debugging
3. Try to authorize
4. Copy the Response XML from the log
5. Paste into an XML validator and see it fails

Expected behavior

The Signature element should appear immediately following the issuer element.

Screenshots

• This image shows the FusionAuth output failing XML validation.
• This image shows it passing when I manually move the Signature element.

Platform

(Please complete the following information)

• Device: MacBook Pro, but the instance is running on Fargate.
• OS: Mac
• Browser + version Chrome
• Database: MySQL

Additional context

N/A

[MrChrisRodriguez]

You can see the correct schema representation here:

https://github.com/FusionAuth/fusionauth-samlv2/blob/master/src/main/xsd/saml-schema-assertion-2.0.xsd#L61

It looks like the offending code may be here:

fusionauth-samlv2/src/main/java/io/fusionauth/samlv2/service/DefaultSAMLv2Service.java

Line 272 in f230fa0

try {

[robotdan]

Thanks for the report @MrChrisRodriguez we will take a look shortly.

[robotdan]

I'll have to dig into this a big further, it seems to be in the correct location so far, I added some additional assertions for the location of the signature element.
c042748

[robotdan]

Think I've got it - when configured to sign the assertion, it was in the correct location, but when configured to sign the response or for an un-successful response - the signature was in the incorrect location.

c1b5650

I produced XML responses for both scenarios and they both passed validation of the SAML Response schema.