Failure to validate Response Signature

[Cantor, Scott]

On 10/5/12 7:12 AM, "Rainer Hoerbe" <rainer at hoerbe.at> wrote:

>I browsed again thru the logs once more to find a potential hints, and
>compared the entityIDs and certificates to make sure that there is no
>typo.

If the metadata is what you think it is, then there's got to be something
wrong with the certificate. Maybe it's a library compatibility issue of
some sort, but if they really match, and they're vanilla RSA public key
certs, I don't know what else it could be.

>These are the log messages after the Response was decoded:

I can't tell without debugging into the code exactly what it's doing. I
know from the error that it found something that abstractly is a
credential from the metadata lookup, but that when it tried to get a
public key out of that credential, it got nothing back. So that's some
information. If the information in the certificate in the message had been
a problem in some way that prevented it from finding a candidate
credential in the metadata, the error would be different.

>So it seems not that the keys are not matching, but the TrustEngin does
>not receive keys from either md or response.

It seems to be breaking in a very low level step of pulling a public key
out of the certificate.

>What could be done to trace this?

A debugger, basically. If you file a bug and attach them, I can do that.
If it works for me, then that means it's a localized issue with the build
or platform.

-- Scott