Failure to validate Response Signature

[Cantor, Scott]

On 10/4/12 1:31 PM, "Rainer Hoerbe" <rainer at hoerbe.at> wrote:

>How do I have to interpret "Credential did not contain a verification
>key"? X509v3 Key Usage is "Digital Signature, non-repudiation".

It couldn't pull anything out of the metadata's KeyDescriptor that fit the
criteria. The main criteria involved is that the public key match, but the
other common case is that there's name matching getting in the way.

Does your KeyInfo in the message have any key name information in it? If
so, it may be at odds with the name extraction the SP is doing from the
metadata's copy of the cert.

Normally that breaks decryption, but I think it could affect this also.
I'm hunting the docs/code to recall if there are options to work around
this problem or not. So far I'm not finding them, but let's see if that's
possibly involved or not.

-- Scott