Failure to validate Response Signature

[Rainer Hoerbe]

> It seems to be breaking in a very low level step of pulling a public key
> out of the certificate.
> 
>> What could be done to trace this?
> 
> A debugger, basically. If you file a bug and attach them, I can do that.
> If it works for me, then that means it's a localized issue with the build
> or platform.

Thanks. I submitted a bug in JIRA.

For the time being I think I cannot use the PKIX trust engine either, as it does not allow for an intermediate CA according the the documentation. 

I tried to exclude the XMLSigning policy, but received a "OneTimeUse condition not successfully validated by policy" message. I wonder, because my understanding was that Shibboleth will maintain a cache of received assertion IDs and reject any reuse.
Adding a <PolicyRule type="Ignore">saml2:OneTimeUse</PolicyRule> under Conditions did not change anything. I even checked that the IDP issued unique IDs for each response and assertion. Is there some documentation to read more about the OneTimeUse?

- Rainer