Failure to validate Response Signature

Thu Oct 4 17:00:03 EDT 2012

Am 04.10.2012 um 21:38 schrieb "Cantor, Scott" <cantor.2 at osu.edu>:

> Does your KeyInfo in the message have any key name information in it? If
> so, it may be at odds with the name extraction the SP is doing from the
> metadata's copy of the cert.

No, there are only <ds:X509Data> and <ds:X509Certificate> elements. Does that mean that the trust engine does only following steps in this case?
- extract <ds:X509Certificate> from response signature (a.k.a. IdP "Credential")
- extract entityID in <issuer> from response and fetch the <EntityDescriptor> addressed by it from metadata. It contains a <X509Certificate> element (a.k.a. "verification key")
- compare both <X509Certificate> elements

- Rainer