Mattermost accepts unsigned SAML assertions or rejects logins after enabling Verify Signature

Applies to: Mattermost Server (reported on 10.11.x and 11.7.x) with SAML 2.0 authentication enabled and SamlSettings.Verify set to false.

Symptoms: Security testing reports that Mattermost accepts unsigned SAML login assertions on /login/sso/saml, or enabling Verify Signature immediately fails all SAML logins with We received an invalid signature in the response from the Identity Provider.

Problem

When SamlSettings.Verify (Verify Signature) is false, Mattermost skips XML signature validation on incoming SAML responses, so an expired or rotated Identity Provider (IdP) signing certificate and an unsigned outer <samlp:Response> go unnoticed. When Verify Signature is set to true, Mattermost requires three conditions to pass: the IdP must sign the outer <samlp:Response> element (signing only the inner <saml:Assertion> is rejected), the Identity Provider Public Certificate (saml-idp.crt) in Mattermost must match the IdP's current non-expired signing certificate, and Signature Algorithm (RSAwithSHA256 or RSAwithSHA1) must match the IdP. If any of these do not match, enabling Verify Signature blocks SAML logins for all users.

Symptoms

• Unsigned SAML login assertions sent to /login/sso/saml are accepted when SamlSettings.Verify is false.
• Enabling Verify Signature fails SAML logins with HTTP 403 We received an invalid signature in the response from the Identity Provider.

Solution

1. Verify local CLI rollback access before changing production settings (especially when email/username login is disabled and SAML is the only sign-in method): run mmctl --local config get SamlSettings.Verify so you can revert with mmctl --local config set SamlSettings.Verify false if login fails.
2. On your Identity Provider (for example, in Microsoft Entra ID under Enterprise Applications > Single sign-on > SAML Certificates > Signing Option, or in ADFS, Okta, or PingFederate), set the signing option to Sign SAML response or Sign SAML response and assertion (not Assertion only), and confirm the signing algorithm (SHA-256 or SHA-1) matches Signature Algorithm in Mattermost.
3. In your dev/staging environment first, and then in production, update the Identity Provider Public Certificate in System Console > Authentication > SAML 2.0 to match the IdP's active, non-expired X.509 signing certificate (upload the current .cer/.crt file or click Get SAML Metadata from IdP) and click Save.
4. Set Verify Signature to true in System Console > Authentication > SAML 2.0 (or run mmctl --local config set SamlSettings.Verify true) and test SAML logins across all application nodes from a private browser window while keeping your existing admin session open.
5. If any unverified sessions or test accounts were created while verification was off, run System Console > User Management > Users > Revoke All Sessions, permanently remove any test-provisioned accounts with mmctl user delete <user> --confirm, and revoke any personal access tokens created during testing.

Important: Do not click Remove Identity Provider Certificate in System Console when SAML is the only login method, as removing the certificate disables SAML sign-in; overwrite the certificate by uploading the updated file directly or via Get SAML Metadata from IdP.

Additional Resources

• Authentication configuration settings — Verify signature
• SAML Single Sign-On technical documentation — SAML responses
• Configure SAML with Microsoft Entra ID
• mmctl command line tool