> ## Documentation Index
> Fetch the complete documentation index at: https://docs.invoca.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 403 Error Logging Into Invoca via SAML/SSO: Invalid Signature

> This 403 error occurs when your identity provider isn't including your x509 certificate in the SAML response Invoca receives.

**Applies to:** SAML SSO integration, customers implementing Invoca's [SAML SSO Setup](/s/article/jhdcp92865-570)

## Symptoms

* A user sees a 403 error when attempting to log in to Invoca via SAML/SSO.
* The SAML response includes an error message reading "Invalid Signature on SAML Response," and the x509 certificate isn't included in the response. You'll need your SSO debugger to see this message.

## Cause

Your identity provider (IdP) has a setting that controls whether your x509 certificate is included in the SAML response sent to Invoca. If that setting isn't enabled, Invoca can't validate the signature.

## Resolution

1. Open your identity provider's configuration settings.
2. Locate the setting that determines whether the certificate is included in the outgoing assertion.
3. If the setting isn't enabled, enable it.
4. Attempt to log in again.

## Where to go next

<CardGroup>
  <Card title="SAML SSO Setup" icon="key" href="/s/article/jhdcp92865-570" horizontal />

  <Card title="Configure SSO with Okta" icon="lock" href="/s/article/configure-sso-with-okta" horizontal />

  <Card title="403 Error Logging Into Invoca via SAML/SSO: Required Attributes" icon="triangle-exclamation" href="/s/article/403-error-saml-sso-required-attributes" horizontal />
</CardGroup>