SAML response invalid Authentication Origin: Application & API Last updated 15 Oct 2026

SAML: Invalid SAML response — signature validation failed / audience mismatch / response expired (NotOnOrAfter)

The service provider rejected the IdP’s SAML assertion — wrong certificate, Audience/Entity ID mismatch, ACS URL mismatch, or clock skew.

Exact message you may see Invalid SAML responseSAML signature validation failedInvalid audienceSAML Response is expiredInvalid Destination
Explore the map of this error Full error map →
Seen on: REST API

Meaning

SAML is unforgiving: the SP must trust the IdP’s current signing certificate, the Audience must equal the SP Entity ID, the Destination/ACS URL must match, and NotBefore/NotOnOrAfter require synced clocks.

Common causes

  • IdP signing certificate rotated (SP has the old one)
  • Entity ID / Audience mismatch
  • ACS URL or Destination mismatch (http vs https, trailing slash)
  • Clock skew making the assertion expired/not yet valid

⚡ Quick fix

  1. Re-import IdP metadata (certificate) on the SP
  2. Make Entity ID and ACS URL identical on both sides
  3. Sync clocks; allow small skew

Detailed fix by platform

Shell

  1. bash
    # decode a SAMLResponse captured from the browser
echo "$SAML_RESPONSE" | base64 -d | xmllint --format - | grep -E 'Audience|Destination|NotOnOrAfter|X509Certificate' | head

How to diagnose

  1. Assertion — Audience, Destination, times
  2. Certificate — Matches metadata?
  3. Clocks — In sync?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Application & API. Errors that are often confused with or caused by this one (click to open):

AADSTS50020 — AADSTS50020: User account from identity provider does not exist in tenant and cannot access the application (Azure)AADSTS50020auth/invalid-credential — Firebase Auth: auth/invalid-credential (auth/wrong-password, auth/user-not-found, auth/invalid-login-credentials) (Authentication)auth/invalid-credenti…Clock skew too great — Kerberos: Clock skew too great (KRB_AP_ERR_SKEW) (Authentication)Clock skew too greatIllegal arguments: undefined, string — bcrypt error: Illegal arguments: undefined, string / data and salt arguments required / data and hash arguments required (Authentication)Illegal arguments: un…NotAuthorizedException — AWS Cognito: NotAuthorizedException: Incorrect username or password (Authentication)NotAuthorizedExceptionUnable to verify secret hash for client — AWS Cognito: NotAuthorizedException: Unable to verify secret hash for client x (Authentication)Unable to verify secr…UserNotConfirmedException — AWS Cognito: UserNotConfirmedException: User is not confirmed. (Authentication)UserNotConfirmedExcep…SAML resp…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.