Submit Feedback
Legacy Knowledge Base
Published Jul. 2, 2025

Failed to verify signature and/or establish trust using any KeyInfo-derived credentials

Written By

Kanchan Bisht

How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!

While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.

Legacy Article

You are viewing an article from our legacy "FastTrack" publication program, made available for informational purposes. Articles in this program were published without a requirement for independent editing or verification and are provided"as is" without guarantee.

Before using any information from this article, independently verify its suitability for your situation and project.

Issue

  • SAML has abruptly stopped working, and no user can log in.
  • The Liferay console contains the following errors: 
    DEBUG [ajp-nio-172.1.129.26-8080-exec-351][BaseSignatureTrustEngine:200] Attempting to establish trust of KeyInfo-derived credential
    DEBUG [ajp-nio-172.1.129.26-8080-exec-351][BaseSignatureTrustEngine:205] Failed to establish trust of KeyInfo-derived credential
    DEBUG [ajp-nio-172.1.129.26-8080-exec-351][BaseSignatureTrustEngine:216] Failed to verify signature and/or establish trust using any KeyInfo-derived credentials
    DEBUG [ajp-nio-172.1.129.26-8080-exec-351][ExplicitKeySignatureTrustEngine:116] Attempting to verify signature using trusted credentials
    DEBUG [ajp-nio-172.1.129.26-8080-exec-351][ExplicitKeySignatureTrustEngine:124] Failed to verify signature using either KeyInfo-derived or directly trusted credentials
    DEBUG [ajp-nio-172.1.129.26-8080-exec-351][SAMLProtocolMessageXMLSignatureSecurityHandler:142] Message Handler:  Validation of protocol message signature failed for context issuer 'MOSPI_WSO2_IS', message type: {urn:oasis:names:tc:SAML:2.0:protocol}Response
    DEBUG [ajp-nio-172.1.129.26-8080-exec-351][BaseSamlStrutsAction:56] com.liferay.saml.runtime.SamlException: org.opensaml.messaging.handler.MessageHandlerException: Validation of protocol message signature failed
    com.liferay.saml.runtime.SamlException: org.opensaml.messaging.handler.MessageHandlerException: Validation of protocol message signature failed

Environment

  • Liferay DXP 7.2 as SP 
  • WSO2 as IdP

Resolution

  • To begin, enable SAML debug level logs (Control Panel > Server Administration > Log Levels), this will help in obtaining the above errors for analysis.
  • The above errors indicate an issue with the way SAML-enabled identity or service providers are interacting with each other.
  • The metadata file in this scenario contains the certificate information, which has expired at the user's end. As a result, in order to narrow down or address this issue, the certificate must be changed, and new metadata should be generated and exchanged.
  • However, to avoid the certificate, try directly generating metadata with the current configuration.

Additional Information

  • SAML metadata is an XML document that contains the information necessary for interaction with SAML-enabled identity or service providers. The document contains e.g. URLs of endpoints, information about supported bindings, identifiers, and public keys. Typically one metadata document will be generated for your own service provider and sent to all identity providers you want to enable single sign-on with. Similarly, each identity provider will make its own metadata available for you to import into your service provider application.
Did this article resolve your issue ?
Legacy Knowledge Base
Did this article resolve your issue ?