title: Getting "Signature validation failed. SAML Response rejected" using python-saml with flask
body: <p>I'm getting the following error when trying to process a IdP-initiated SAML2 response using python-saml and flask:</p>
  
  <pre><code>Signature validation failed. SAML Response rejected
  </code></pre>
  
  <p>I'm following the example <a href="https://github.com/onelogin/python-saml/blob/master/demo-flask/index.py" rel="noreferrer">here</a>. My code is:</p>
  
  <pre><code>url_data = urlparse(request.url)
  req = {
      "https": "on",
      "http_host": request.host,
      "server_port": url_data.port,
      "script_name": request.path,
      "get_data": request.args.copy(),
      "post_data": request.form.copy()
  }
  auth = OneLogin_Saml2_Auth(req, custom_base_path=app.config['SAML_PATH'])
  auth.process_response()
  </code></pre>
  
  <p>In SAML_PATH, I have the following in my <code>settings.json</code> file:</p>
  
  <pre><code>{
      "strict": false,
      "debug": true,
      "sp": {
          "entityId": "[spEntityId]",
          "assertionConsumerService": {
              "url": "[acsUrl]",
              "binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
          },
          "NameIDFormat": "urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified",
          "x509cert": "[x509cert]",
          "privateKey": "[privateKey]"
      },
      "idp": {
          "entityId": "[idpEntityId]",
          "singleSignOnService": {
              "url": "http://dummy.com/saml2",
              "binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
          },
          "singleLogoutService": {
              "url": "http://dummy.com/saml2",
              "binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
          },
          "x509cert": "[x509cert]"
      },
      "security": {
          "nameIdEncrypted": false,
          "authnRequestsSigned": false,
          "logoutRequestSigned": false,
          "logoutResponseSigned": false,
          "signMetadata": false,
          "wantMessagesSigned": true,
          "wantAssertionsSigned": true,
          "wantNameIdEncrypted": false,
          "requestedAuthnContext": false
      }
  }
  </code></pre>
  
  <p>As you can see, I've used dummy values for the IdP singleSignOnService and singleLogoutService URLs. I don't think I need them in my case as I just need to process the SAML Response. I've also using the same x509cert for both the SP and IdP. The response has a signed message and encrypted assertion:</p>
  
  <pre><code>    &lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="[Destination]" ID="[ID]" IssueInstant="2015-11-30T15:35:02.702Z" Version="2.0"&gt;
      &lt;saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"&gt;
          [Issuer]
      &lt;/saml2:Issuer&gt;
      &lt;saml2p:Status&gt;
          &lt;saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /&gt;
      &lt;/saml2p:Status&gt;
      &lt;saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"&gt;
          &lt;xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Id="[ID]" Type="http://www.w3.org/2001/04/xmlenc#Element"&gt;
              &lt;xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" /&gt;
              &lt;ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
                  &lt;xenc:EncryptedKey Id="[ID]" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"&gt;
                      &lt;xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" /&gt;
                      &lt;xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"&gt;
                          &lt;xenc:CipherValue&gt;
                              [CipherValue]
                          &lt;/xenc:CipherValue&gt;
                      &lt;/xenc:CipherData&gt;
                  &lt;/xenc:EncryptedKey&gt;
              &lt;/ds:KeyInfo&gt;
              &lt;xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"&gt;
                  &lt;xenc:CipherValue&gt;
                      [CipherValue]
                  &lt;/xenc:CipherValue&gt;
              &lt;/xenc:CipherData&gt;
          &lt;/xenc:EncryptedData&gt;
      &lt;/saml2:EncryptedAssertion&gt;
  &lt;/saml2p:Response&gt;
  </code></pre>
  
  <p>I've verified that the x509cert and privateKey are correct. I'm new to SAML2, so I'm hoping it's something simple :) Thank you in advance!!</p>