ADFS :Opensaml2 Integration: Signature did not validate against the credential's key

[Cantor, Scott]

On 2/15/14, 9:26 PM, "smita.sree2007 at gmail.com" <smita.sree2007 at gmail.com>
wrote:
>
>Thanks Scott, for looking into this issue. We are not able to make sure
>the key is right.

Then you're going to have a very hard time.

> Client tells that they use ADFS's tokensigning certificate to sign the
>response and ADFS's communication certificate is the one uploaded in our
>SP server. The flow works fine, if the IDP cleint uses a test certificate
>given by us. So Will there be any issue with the certificate which , the
>IDP client used through ADFS, If so how can we identify? Is there any way
>to identify the mismatch between the signing certificate and the public
>key certificate? >From the OpenSAML debug log(attached in first email
>thread), I couldn't get any useful information to identify the issue?
>Thanks Smitha

The IdP does not validate certificates like that, not without extra work
in the metadata to provide trust anchors. Either the request is corrupted,
or more likely the key they gave you isn't correct. That's all I can tell
you.

I don't even remember anymore what the message type is here, but if it's
an XML Signature, the link I gave you has what you need to proceed if you
have no other information. If it's a redirect signature, that's a more
complex situation for debugging.

-- Scott