# Keyclaok adding escape character 
 in signature value in SAML response

**URL:** <https://forum.keycloak.org/t/keyclaok-adding-escape-character-13-in-signature-value-in-saml-response/17544>\
**Category:** Miscellanaeous\
**Created:** [September 21, 2022, 4:30pm UTC](https://forum.keycloak.org/t/keyclaok-adding-escape-character-13-in-signature-value-in-saml-response/17544 "2022-09-21T16:30:34Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![acaselli](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/acaselli/32/6544_2.png) [@acaselli](https://forum.keycloak.org/u/acaselli)\
**Post date:** [September 21, 2022, 4:30pm UTC](https://forum.keycloak.org/t/keyclaok-adding-escape-character-13-in-signature-value-in-saml-response/17544/1 "2022-09-21T16:30:34Z")

</div>

I am trying to set up Keycloak as IdP and use it for SSO. The first re-direct (from the application login url to keycloak) works fine, but then, after entering the user credentials I get an “invalid signature” error from the application.

I have checked the SAML response (from keycloak to the application) and I can see that keycloak adds a weird escape character in the certificate and signature value.

Here is part of the SAML response:

```auto
<dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
    <dsig:SignedInfo>
      <dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
      <dsig:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
      <dsig:Reference URI="#ID_fde25c3e-6958-4b49-bbe0-e4aeb200de98">
        <dsig:Transforms>
          <dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
          <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></dsig:Transforms>
        <dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
        <dsig:DigestValue>p3ldrwhvbO1zoeHlhCx9TdZ01hGnw3f3IqBDIT5e1oU=</dsig:DigestValue>
      </dsig:Reference>
    </dsig:SignedInfo>
    <dsig:SignatureValue>
iGNKaLxr3c9CUPpRxC3xeS0grx2FdcXWcWArlqZHdWIjQF0n9Whh5ue00HEmb+Nr5VO9jBUwRwXl&#13; VNEARy/4DeAsuXIxej0OYASBMjx+5qfmUIelXKLChTYjrdHyq2ZtD7BWfCrnNLtB7XiZsy8cYm0v&#13; ynWLlJTyxUpg+FakcxGNDnSUG6Ofslv6byQDsNY56yvqKCWbcqa1/70PD401E/Gf2XcD4paPAvHX&#13; B+wS25QFytqrxumRtlJiKcPS+IB8umpcHG4mKk3Qg9FxCRQk2Pk693VnEtYyQ5VXUTNFW8SfWpnQ&#13;
      xDNSE6h2cevj4nT7NSQDxoNh1LRBokwjUNJWQg==
    
</dsig:SignatureValue>

```

Why is keycloak adding all these escape characters ( )?  
Is there a way to force it not to send it? I spoke with another developer who has more experience than me with SAML and she told me she has never seen a signature value with escape characters.  
have I misconfigured something? Keycloak is running in a docker container and I am using nginx as reverse proxy.

EDIT: I am running keycloak in a docker container using NGINX as reverse proxy. The question is: is keycloak or nginx that are adding these ASCII code 13 characters? And of course, how do I fix it?

---

<div class="post-metadata">

**Author:** ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)\
**Post date:** [September 22, 2022, 8:43pm UTC](https://forum.keycloak.org/t/keyclaok-adding-escape-character-13-in-signature-value-in-saml-response/17544/2 "2022-09-22T20:43:31Z")

</div>

Blame your Nginx. I guess you are using HTTP Redirect SAML binding, so Nginx is encoding request parameter.

I would switch to HTTP POST binding (you never know which infrastructure is between user and keycloak, which may be doing URL encoding, which can use this problem).  
If it is not possible, then [configure proxy pass in the nginx config without URI](https://serverfault.com/questions/459369/disabling-url-decoding-in-nginx-proxy).

---

<div class="post-metadata">

**Author:** ![acaselli](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/acaselli/32/6544_2.png) [@acaselli](https://forum.keycloak.org/u/acaselli)\
**Post date:** [September 23, 2022, 7:49am UTC](https://forum.keycloak.org/t/keyclaok-adding-escape-character-13-in-signature-value-in-saml-response/17544/3 "2022-09-23T07:49:27Z")

</div>

Hi @jangaraj ,  
Thank you so much for your reply!!  
Sorry for the stupid question but where do I know if I am using HTTP Redirect or POST?  
In the application SAML configuration file I have a field called “Single Sign-On Bind” and I have set it to “HTTP-POST”.

In the keycloak client page, I have switched on the “Force POST Binding” option, then under “Fine Grain SAML Endpoint Configuration”, I have only filled the “Assertion Consumer Service POST Binding URL” and I have left blank “Assertion Consumer Service Redirect Binding URL”.  
I am still getting the same error and the ASCII characters are still there. What am I doing wrong?

I will try now to configure proxy pass as you suggested.

EDIT:  
In keycloak I have the URLs, one for the internal/admin site and one for the public one.

I have two proxy pass rules already set up

location / {  
proxy\_pass [http://firstwebsite.com](http://firstwebsite.com);  
}

location / {  
proxy\_pass [http://secondwebsite.com](http://secondwebsite.com);  
}

Shouldn’t this be enough?

EDIT2:  
I have installed SAML message decoder as a Chrome extension.  
I have tested both methods “redirecting” and “post” and the ASCII character is in both. Are we sure that is NGINX to blame?

---

<div class="post-metadata">

**Author:** ![mbonn](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/mbonn/32/5755_2.png) [@mbonn](https://forum.keycloak.org/u/mbonn)\
**Post date:** [September 23, 2022, 9:51am UTC](https://forum.keycloak.org/t/keyclaok-adding-escape-character-13-in-signature-value-in-saml-response/17544/4 "2022-09-23T09:51:46Z")

</div>

The XML data of the SAML auth requests and the assertion responses are consistently encoded in Base64 or Base64URL, regardless of whether POST or REDIRECT is used. This is so that they can be transported without any problems and a proxy cannot break anything. That’s why I wouldn’t mess around with nginx any further. I suspect that the XML/Crypto libraries used are messing up here.  
You are not the only one with this problem:[https://github.com/keycloak/keycloak/discussions/14500](https://github.com/keycloak/keycloak/discussions/14500)

---

<div class="post-metadata">

**Author:** ![acaselli](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/acaselli/32/6544_2.png) [@acaselli](https://forum.keycloak.org/u/acaselli)\
**Post date:** [September 23, 2022, 10:35am UTC](https://forum.keycloak.org/t/keyclaok-adding-escape-character-13-in-signature-value-in-saml-response/17544/5 "2022-09-23T10:35:34Z")

</div>

Thank you @mbonn

So this is a bug. Any suggestions on how to report it?

---

<div class="post-metadata">

**Author:** ![mbonn](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/mbonn/32/5755_2.png) [@mbonn](https://forum.keycloak.org/u/mbonn)\
**Post date:** [September 23, 2022, 12:23pm UTC](https://forum.keycloak.org/t/keyclaok-adding-escape-character-13-in-signature-value-in-saml-response/17544/6 "2022-09-23T12:23:53Z")

</div>

You already did a bug report, didn’t you?  
[https://github.com/keycloak/keycloak/issues/14529](https://github.com/keycloak/keycloak/issues/14529)

---

<div class="post-metadata">

**Author:** ![acaselli](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/acaselli/32/6544_2.png) [@acaselli](https://forum.keycloak.org/u/acaselli)\
**Post date:** [September 23, 2022, 1:47pm UTC](https://forum.keycloak.org/t/keyclaok-adding-escape-character-13-in-signature-value-in-saml-response/17544/7 "2022-09-23T13:47:19Z")

</div>

You are right! My bad.

---

<div class="post-metadata">

**Author:** ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)\
**Post date:** [September 23, 2022, 7:02pm UTC](https://forum.keycloak.org/t/keyclaok-adding-escape-character-13-in-signature-value-in-saml-response/17544/8 "2022-09-23T19:02:27Z")

</div>

> [@acaselli](#):
>
> I have installed SAML message decoder as a Chrome extension.  
> I have tested both methods “redirecting” and “post” and the ASCII character is in both. Are we sure that is NGINX to blame?

Try to test your setup without Nginx (and any infra between browser and Keycloak, which may modify request) - then you can say that’s not a problem of the Nginx. Your Nginx config looks OK, so in this case it is very low chance that Nginx is causing a problem.

---

<div class="post-metadata">

**Author:** ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)\
**Post date:** [September 23, 2022, 7:08pm UTC](https://forum.keycloak.org/t/keyclaok-adding-escape-character-13-in-signature-value-in-saml-response/17544/9 "2022-09-23T19:08:38Z")

</div>

> [@mbonn](#):
>
> The XML data of the SAML auth requests and the assertion responses are consistently encoded in Base64 or Base64URL, regardless of whether POST or REDIRECT is used.

I agree. But it can be more complicated. I have had real use case, where misconfigured proxy, WAF was changing SAML request/response and then whole SAML login was failing.

---

<div class="post-metadata">

**Author:** ![mbonn](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/mbonn/32/5755_2.png) [@mbonn](https://forum.keycloak.org/u/mbonn)\
**Post date:** [September 26, 2022, 8:32am UTC](https://forum.keycloak.org/t/keyclaok-adding-escape-character-13-in-signature-value-in-saml-response/17544/10 "2022-09-26T08:32:27Z")

</div>

Well, I hope the Keycloak team is investigating this. Broken SAML signatures are an absolute show stopper for my use-cases…

---

<div class="post-metadata">

**Author:** ![acaselli](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/acaselli/32/6544_2.png) [@acaselli](https://forum.keycloak.org/u/acaselli)\
**Post date:** [September 29, 2022, 2:48pm UTC](https://forum.keycloak.org/t/keyclaok-adding-escape-character-13-in-signature-value-in-saml-response/17544/11 "2022-09-29T14:48:07Z")

</div>

I hope so too, but this is not very encouraging… [[KEYCLOAK-8594] HTTP-Redirect violates SAML spec, base64 in URL contains whitespace - Red Hat Issue Tracker](https://issues.redhat.com/browse/KEYCLOAK-8594)