OpenSAML ValidationException in 2.5.1 when using signResponses="conditional"

[Christopher Bongaarts]

When changing the OpenSAML jar for an app from 2.5.0 to 2.5.1, we 
started getting this error message when trying to validate the signature 
of a SAML2 AuthnResponse:

org.opensaml.xml.validation.ValidationException: SignableSAMLObject does 
not have a cached DOM Element.
     at 
org.opensaml.security.SAMLSignatureProfileValidator.validateReferenceURI(SAMLSignatureProfileValidator.java:146)
     at 
org.opensaml.security.SAMLSignatureProfileValidator.validateSignatureImpl(SAMLSignatureProfileValidator.java:84)
     at 
org.opensaml.security.SAMLSignatureProfileValidator.validate(SAMLSignatureProfileValidator.java:56)
[...]

when the Shib IdP is configured with the default SAML2SSO profile 
configuration of

     signResponses="conditional"
     signAssertions="never"

If we flip these settings around to:

     signResponses="never"
     signAssertions="always"

it works (the signature is sucessfully verified).

We haven't seen this occur on any other SPs, so I'm guess that this app 
is not quite calling OpenSAML correctly (i.e. to get the DOM cached 
before calling o.o.s.s.validate...)

Any ideas what this could be?
-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%