17103 FIX Could not log in with SAML2 if signing certificate was in trust store

Signing the SAML2 authentication request was failing if the certificate
used for signing was also in the Checkmk CA trust store. The reason lies
in the way that pysaml2 invokes xmlsec1, which causes OpenSSL to try to
sign the request using the public key from the cert store.

As a workaround, we unset the SSL_CERT_FILE environment variable, so
OpenSSL doesn't find the certificate.

See also:
 - lsh123/xmlsec#939
 - IdentityPython/pysaml2#998

SUP-24452

Change-Id: Icf8fccefc05680b246d932a565161cf22a45786d

Author: hrantzsch

.werks/17103.md

@@ -0,0 +1,19 @@
+[//]: # (werk v2)
+# Could not log in with SAML2 if signing certificate was in trust store
+
+key        | value
+---------- | ---
+date       | 2025-07-25T07:56:26+00:00
+version    | 2.4.0p9
+class      | fix
+edition    | cee
+component  | wato
+level      | 1
+compatible | yes
+
+Logging in via a SAML2 connection failed if the certificate configured for signing the SAML requests was also in the Checkmk CA trust store or in the global system trust store.
+
+In this case, clicking the "Login with SAML connection" button failed with "Unable to create authentication request. Please contact your administrator".
+A SignatureError for trying to sign the request XML with xmlsec1 was visible in the web.log.
+
+This is now fixed.