Hi everyone, I'm using Keycloak 4.0.0.Beta2, and I'm trying to sign AuthnRequests from a Service Provider (Ruby Omniauth) to Keycloak. On Keycloak, I have set the "Client Signature Required" to On. I have set Ominauth parameters with the following values : "security" => { "authn_requests_signed" => true, "embed_sign" => true, "digest_method" => "XMLSecurity::Document::SHA1", "signature_method" => "XMLSecurity::Document::RSA_SHA1", } I also have copied-pasted the SAML keys from Keycloak to the SP. When initiating a SAML request at the SP, I am redirected to an error page with "Invalid requester" on Keycloak. In the logs, I got the following : 08:49:19,057 ERROR [org.keycloak.protocol.saml.SamlService] (default task-64) request validation failed: org.keycloak.common. VerificationException: SigAlg was null at org.keycloak.protocol.saml.SamlProtocolUtils. verifyRedirectSignature( SamlProtocolUtils.java:135) at org.keycloak.protocol.saml.SamlService$RedirectBindingProtocol. verifySignature(SamlService.java:518) at org.keycloak.protocol.saml.SamlService$BindingProtocol. handleSamlRequest(SamlService.java:233) ... 08:49:19,058 WARN [org.keycloak.events] (default task-64) type=LOGIN_ERROR, realmId=master, clientId=null, userId=null, ipAddress=10.42.128.4, error=invalid_signature It seems that Keycloak can't read the Signature Algorithm value. I checked the SAML data, and the SignatureMethod is set : <ds:SignatureMethod Algorithm="XMLSecurity::Document::RSA_SHA1" /> I checked my parameters, certificates (tried to use new ones), but I always get this error. What am I doing wrong ? Does anyone managed to sign their AuthnRequests or encountered the same errors ? I haven't found anything similar on the internet. Thanks in advance, Regards, Pierre Dupont _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user