Over a million developers have joined DZone.

How to Write a Custom SAML SSO Assertion Signer for WSO2 Identity Server

DZone's Guide to

How to Write a Custom SAML SSO Assertion Signer for WSO2 Identity Server

Free Resource

Want to learn more about API monitoring? Learn how Trustpilot monitors over 600 microservices with Runscope on this webinar.

This is the 3rd post I am writing to explain the use of extension points in WSO2 Identity Server. WSO2 Identity Server has so many such extension points which are easily configurable and arm the server with lot of flexibility. With this, we can support so many domain specific requirements with minimum efforts.

  • Now this third post deals with writing a custom SAML SSO Assertion signer.

What we can customize?

  • Credentials used to sign the SAML Assertion (The private key)
  • Signing Algorithm
  • This sample can be extended to customize how we sign the SAML Response and validate the signature as well.


We have to write a class extending 
  • The class 'org.wso2.carbon.identity.sso.saml.builders.signature.DefaultSSOSigner' or
  • The interface 'org.wso2.carbon.identity.sso.saml.builders.signature.SSOSigner'
Needs to override the following method in our case to customize how we sign the assertion,

    public Assertion doSetSignature(Assertion assertion, String signatureAlgorithm, X509Credential cred) throws IdentityException {

        try {
            //override the credentials with our desired one
            cred = getRequiredCredentials();
            Signature signature = (Signature) buildXMLObject(Signature.DEFAULT_ELEMENT_NAME);

            try {
                KeyInfo keyInfo = (KeyInfo) buildXMLObject(KeyInfo.DEFAULT_ELEMENT_NAME);
                X509Data data = (X509Data) buildXMLObject(X509Data.DEFAULT_ELEMENT_NAME);
                X509Certificate cert = (X509Certificate) buildXMLObject(X509Certificate.DEFAULT_ELEMENT_NAME);

                String value = org.apache.xml.security.utils.Base64.encode(cred
            } catch (CertificateEncodingException e) {
                throw new IdentityException("errorGettingCert");


            List<Signature> signatureList = new ArrayList<Signature>();

            // Marshall and Sign
            MarshallerFactory marshallerFactory = org.opensaml.xml.Configuration
            Marshaller marshaller = marshallerFactory.getMarshaller(assertion);


            return assertion;
        } catch (Exception e) {
            throw new IdentityException("Error while signing the SAML Response message.", e);
Finally we have to update the identity.xml() as below with the above custom class we write overriding the methods.
and place the compiled package with the above class at 'IS_HOME/repository/components/lib' 
Now if we restart the server and run the SAML SSO scenario, the SAML SSO Assertion will be signed in the way we defined at the custom class we wrote.

Here you can find a complete sample code to customize the assertion signing procedure.

Are your customers the first to know when your API is failing? Watch this webinar to learn how Trustpilot monitors over 600 microservices with Runscope, and are always on top of any API errors.


Published at DZone with permission of

Opinions expressed by DZone contributors are their own.

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.urlSource.name }}