This article explains why a 400 error may occur when users attempt to access an Identity Provider (IdP). The following error is present in the Okta System Logs:

Unable to validate incoming SAML Assertion with the Error Message: The digital signature algorithm used in the SAML response does not meet the minimum requirements. Required "SHA-256", but received "SHA-1".

• Security Assertion Markup Language (SAML)
• Identity Provider (IdP)
• Single Sign On

The error occurs because the IdP is sending a SHA-1 certificate, but a SHA-256 certificate is required.

There are two possible solutions: 

• Contact the IdP and request that the signature algorithm be changed to SHA-256.
  • NOTE: This is the recommended solution.
• Change the signature algorithm to SHA-1 in the Identity Provider settings within Okta.
  • NOTE: This solution is not recommended as SHA-1 is less secure than SHA-256.