What the message looks like
OneLogin\Saml2\ValidationError: Signature validation failed. SAML Response rejectedCommon causes
- The identity provider (Entra ID, ADFS, Keycloak) rotated its signing certificate and Nextcloud still has the old one.
- The wrong certificate is stored, e.g. the encryption instead of the signing certificate.
- Signature settings do not match: Nextcloud expects signed assertions while the IdP only signs the response (or vice versa).
- The certificate was damaged while copying (line breaks, missing characters).
Check
- Show the SAML configuration in Nextcloud
sudo -u www-data php /var/www/nextcloud/occ saml:config:get - Read the current IdP certificates from the metadata
curl -s https://sso.example.com/realms/main/protocol/saml/descriptor | grep -o '<ds:X509Certificate>[^<]*' - Fingerprint and expiry of the stored certificate
openssl x509 -in idp.crt -noout -fingerprint -sha256 -enddate - Find SAML errors in the Nextcloud log
grep -i 'saml' /var/www/nextcloud/data/nextcloud.log | tail -n 5
Fix
- Paste the current signing certificate from the IdP metadata into Nextcloud's SSO settings (Base64 block only, no blank lines).
- Align signature options with the IdP, e.g. signed assertions vs. signed response.
- For planned rotations, add the new certificate in time if the IdP uses both in parallel.
- For debugging, set
loglevelto 0 briefly and revert afterwards.
FAQ
Is this about the website's TLS certificate?
No. SAML uses a separate signing certificate from the IdP. Nextcloud's HTTPS certificate plays no role here.
Why did it work yesterday?
Almost always the IdP certificate was renewed. Entra ID and ADFS rotate automatically; compare the fingerprint in the metadata with the one in Nextcloud.