<html><body><div style="color:#000; background-color:#fff; font-family:tahoma, new york, times, serif;font-size:10pt">Brent,<br><br>I am using opensaml2.5.3. I see the same error when I use opensaml 2.6.0<br><br>I am using xercesImpl-2.10.0, xalan-2.7.1<br><br>I checked that the reference URI has the id of the response (although it does have a '#' before it)<br><br>The SAML Response: <br>&lt;?xml version="1.0" encoding="UTF-8"?&gt;<br>&lt;saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://localhost:8443/SamlSP/ACS" <br><span style="font-weight: bold;">ID="_3c0dece1a0427717acb353977f3c3b3c"</span> IssueInstant="2013-05-13T19:16:26.203Z" Version="2.0" xmlns:xs="http://www.w3.org/2001/XMLSchema"&gt;<br><br>&lt;saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"&gt;SP&lt;/saml2:Issuer&gt;<br><br>&lt;ds:Signature
 xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;<br>&nbsp;&nbsp;&nbsp; &lt;ds:SignedInfo&gt;<br>&nbsp;&nbsp;&nbsp; &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;<br>&nbsp;&nbsp;&nbsp; &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;<br>&nbsp;&nbsp;&nbsp; <span style="font-weight: bold;">&lt;ds:Reference URI="#_3c0dece1a0427717acb353977f3c3b3c"&gt;</span><br>&nbsp;&nbsp;&nbsp; &lt;ds:Transforms&gt;<br>&nbsp;&nbsp;&nbsp; &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/&gt;<br>&nbsp;&nbsp;&nbsp; &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;&lt;ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="xs"/&gt;&lt;/ds:Transform&gt;<br>&nbsp;&nbsp;&nbsp; &lt;/ds:Transforms&gt;<br>&nbsp;&nbsp;&nbsp; &lt;ds:DigestMethod
 Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;&lt;ds:DigestValue&gt;Qzow2pLKwlsBBn0ewQt3m2ETvuw=&lt;/ds:DigestValue&gt;&lt;/ds:Reference&gt;<br>&nbsp;&nbsp;&nbsp; &lt;/ds:SignedInfo&gt;<br><br>&nbsp;&nbsp;&nbsp; &lt;ds:SignatureValue&gt;M4qnr3eVW3CIfpGPiV5jsmdy0kVfbOWuHEzHWD1jSysC2HgmTNqOraJGUUE2Y59I2yZOF1U7E7Ubo89yaZVXd/k4RLKVAHV/WpOthdVVDIW61N3qS//Y8HFEHahwpXnxNVGhMZgzfJmtQt0QW2DRNh2D+oRW/N2ECj7XfMABUQQ=<br>&nbsp;&nbsp;&nbsp; &lt;/ds:SignatureValue&gt;<br>&nbsp;&nbsp;&nbsp; <br>&nbsp;&nbsp;&nbsp; &lt;ds:KeyInfo&gt;<br>&nbsp;&nbsp;&nbsp; &lt;ds:X509Data&gt;<br>&nbsp;&nbsp;&nbsp;
 &lt;ds:X509Certificate&gt;MIICBjCCAW8CBgE+hflknjANBgkqhkiG9w0BAQsFADBJMSYwJAYDVQQLEx1Ub3R2c0xhYnMgUHJp<br>bWFyeSBDZXJ0aWZpY2F0ZTESMBAGA1UEChMJVG90dnNMYWJzMQswCQYDVQQGEwJVUzAeFw0xMzA1<br>MDgyMTA4MzRaFw0xMzA1MDkxMTAyNTlaMEkxJjAkBgNVBAsTHVRvdHZzTGFicyBQcmltYXJ5IENl<br>cnRpZmljYXRlMRIwEAYDVQQKEwlUb3R2c0xhYnMxCzAJBgNVBAYTAlVTMIGfMA0GCSqGSIb3DQEB<br>AQUAA4GNADCBiQKBgQCcx7YdEFnTpzhrY/yAAWR5HkDxYqXaLID1GaEZWJht90Lk3uIr8qJVwIso<br>Ee3RpZ8DNVm3688R9sqgHflMqzzsusFpqfHo9mD4O09C6UVraubhixlc80KegbgSSwTgj+KH+uFF<br>mZxfgXQPobNvJIB4tii4AVko8gNfDgHciIc1ywIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAFhN800k<br>WS4GfeToknLIRzSz6V/gBtFYJumLizx83L4YrKfnm9rjkj5RO7REvaawlM2Ixfv329gJtJJdmDha<br>LVCVMU7bi0ESKp3dDjJJpW1mcNNAj6FcTbSYTS6pgu5cLsUAoGdh3+VFmmAyKb6cjRvBmHHyHx3p<br>wEpFpPQYNffn<br>&lt;/ds:X509Certificate&gt;<br>&lt;/ds:X509Data&gt;<br>&lt;/ds:KeyInfo&gt;<br>&lt;/ds:Signature&gt;<br><div><span><br></span></div><div><br></div>  <div style="font-family: tahoma, new york, times, serif;
 font-size: 10pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div class="y_msg_container"> <hr size="1"><font face="Arial" size="2"><b><span style="font-weight:bold;"></span></b></font><br>To unsubscribe from this list send an email to <a ymailto="mailto:dev-unsubscribe@shibboleth.net" href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a><br><br></div> </div> </div>  </div></body></html>