Failure to validate Response Signature

[Peter Schober]

* Rainer Hoerbe <rainer at hoerbe.at> [2012-10-04 18:07]:
> Peter suggested to make an explicit configuration of the explicit
> trust engine to produce more messages.

Not more messages, only to spare you the false negatives of the PKIX
trust engine (i.e., let it fail only trying explicit trust).

> BTW, the wiki explains elements and attributes, but does not provide
> an example.

It's now all defaulted. See example-shibboleth2.xml from the
distribution for examples. But it's probably not worth it as the logs
from the explicit trust failing would be there either way (only the
other's wouldn't),
-peter