The SAML signature was valid. That was never the problem.

Your SP validated the assertion signature, pinned the certificate, and logged the user in. Every check passed. I still replayed a login I captured an hour ago. The trick was not breaking the signature. It was deleting a field the signature never covered.

Raccontata dadev.to