Skip to main content
This 403 error occurs when your identity provider isn’t including your x509 certificate in the SAML response Invoca receives.
Applies to: SAML SSO integration, customers implementing Invoca’s SAML SSO Setup

​
Symptoms

  • A user sees a 403 error when attempting to log in to Invoca via SAML/SSO.
  • The SAML response includes an error message reading “Invalid Signature on SAML Response,” and the x509 certificate isn’t included in the response. You’ll need your SSO debugger to see this message.

​
Cause

Your identity provider (IdP) has a setting that controls whether your x509 certificate is included in the SAML response sent to Invoca. If that setting isn’t enabled, Invoca can’t validate the signature.

​
Resolution

  1. Open your identity provider’s configuration settings.
  2. Locate the setting that determines whether the certificate is included in the outgoing assertion.
  3. If the setting isn’t enabled, enable it.
  4. Attempt to log in again.
Last modified on October 9, 2026