The configuration uses the default secret salt - make sure you modify the default 'secretsalt' option in the simpleSAML configuration in production environments. [Read more about nCapsule configuration ]