403 Error Logging Into Invoca via SAML/SSO: Invalid Signature

This 403 error occurs when your identity provider isn’t including your x509 certificate in the SAML response Invoca receives.

​

Symptoms

• A user sees a 403 error when attempting to log in to Invoca via SAML/SSO.
• The SAML response includes an error message reading “Invalid Signature on SAML Response,” and the x509 certificate isn’t included in the response. You’ll need your SSO debugger to see this message.

​

Cause

​

Resolution

1. Open your identity provider’s configuration settings.
2. Locate the setting that determines whether the certificate is included in the outgoing assertion.
3. If the setting isn’t enabled, enable it.
4. Attempt to log in again.

​

Where to go next