Failure to validate Response Signature

[Cantor, Scott]

On 10/4/12 4:44 AM, "Rainer Hoerbe" <rainer at hoerbe.at> wrote:

>I am using the default security policy in a SP 2.5 configuration. The
>IdP's metadata contains the certificate, a diff on the values of
><ds:X509Certificate> in response and metadata does not show any
>difference. Yet the SP complains:
>ERROR XMLTooling.TrustEngine.PKIX [2]: certificate name was not acceptable
>ERROR OpenSAML.SecurityPolicyRule.XMLSigning [2]: unable to verify
>message signature with supplied trust engine
>
>In my understanding the explicit trust engine is first, and PKIX is
>second. I do not understand the second error message.

The second message means that it failed to match the signature key with
the key in the metadata you gave it, so it fell through and then you
usually end up with that kind of message if the intended trust model was
the initial one.

-- Scott