SSL VPN SAML Authentication Fails with Error 'Failed to verify signature' Using Casdoor as SAML IDP

[LibiaoRobot]

Error message:
/saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response>
__samld_sp_login_resp [826]: Failed to process response message. ret=-111(Failed to verify signature.)
samld_send_common_reply [91]: Code: 1, id: 539, pid: 5739, len: 64, data_len 48
samld_send_common_reply [99]: Attr: 22, 12,
samld_send_common_reply [99]: Attr: 23, 36, Failed to verify signature.
samld_send_common_reply [119]: Sent resp: 64, pid=5739, job_id=539.
[5739:root:0]epoll saml recv resp error.
[5740:root:216]Timeout for connection 0x7f7ebad000.

My SAML IDP uses Casdoor, which is an open source identity authentication system. I made sure my certificate is the public key certificate imported from the Casdoor system.

[Markus_M]

Make also sure that the Alibaba Cloud Root CA (that signed the intermediate CA) is imported.

[LibiaoRobot · Accepted solution]

This error is not a problem with the self-signed certificate, but because both parties use different SAML versions. Fortinet firewall uses C14N 1.0 version, and the signature encryption method uses sha256, so it is feasible to use a self-signed certificate. Fortinet firewall only needs the public key.