DocumentationExperience Cloud KCS

AEM SAML SSO authentication fails due to invalid signature

Last update: September 8, 2026

This article explains how to resolve SAML authentication failures in Adobe Experience Manager (AEM) caused by an invalid or mismatched signing certificate. Authentication requests fail because AEM cannot validate the signature in the SAML assertion. To resolve the issue, verify the Identity Provider (IdP) signing certificate, update the AEM Trust Store configuration, and confirm that the correct certificate alias is configured.

Description description

Environment

Adobe Experience Manager (AEM), all versions

Issue/Symptoms

  • SSO login to the AEM Author environment fails, while login with administrative credentials succeeds.

  • The following error message appears: Token SAML not validate.

  • SAML logs contain errors such as:

    • Invalid Assertion: Signature invalid.
    • Login failed. SAML token invalid.
    • SAML error with reason: invalid_token detected, redirect user to: /libs/granite/core/content/login.error.html?j_reason=invalid_token

  • The issue is reproducible when signing in through the AEM Author endpoint.

  • No recent changes were made to the SSO configuration in AEM.

  • The issue started unexpectedly after previously functioning correctly.

Root Cause

The SAML authentication failure occurs because the signing certificate configured in the Identity Provider (IdP) does not match the certificate stored in the AEM Trust Store. As a result, AEM cannot validate the SAML assertion signature.

Resolution resolution

Follow the steps below to resolve the issue:

  1. Obtain the current signing certificate and SAML metadata from the Identity Provider (IdP).
  2. Verify that the certificate fingerprint, subject, issuer, and validity dates match the certificate configured in AEM.
  3. In AEM, navigate to Tools > Security > Trust Store and confirm that the certificate in the Trust Store matches the active IdP signing certificate.
  4. Verify that the idpCertAlias property in the SAML Authentication Handler configuration points to the correct certificate alias.
  5. If the certificate is missing or outdated, install or update the certificate in the AEM Trust Store.
  6. Save and apply the configuration changes.
  7. Attempt to sign in through SSO and verify whether authentication succeeds.
  8. If the issue persists, capture a failing SAML response using a tool such as SAML Tracer. Extract the certificate from ds:Signature > ds:KeyInfo > ds:X509Data > ds:X509Certificate and compare it with the certificate configured in AEM.
recommendation-more-help
experience-cloud-kcs-help-kbarticles