Validation of protocol message signature failed

[Cantor, Scott]

> To be specific, I am using SP .jks file in IDP tester code to generate the
> saml authn signed request and redirecting to IDP. I could see the complete
> saml authn request in idp-process.log with signature information. The
> <X509Certificate> in the signature in the idp-process.log is matching the
> sp.crt information which I used for signing the saml authn request.

That means nothing if the metadata is not correct.

> 
> Since my IDP tester code is stand alone, there is no way to have sp metadata
> file.

You cannot make the IdP work unless you supply metadata about the SP to it.

> To validate the signed saml request, I copied the CA cert into
> idp-metadata.xml but this is not correct as per your suggestion.
> Generally in which config file do we keep the CA cert information on IDP.

I told you what to do, you need to supply metadata, including the signing key or certificate, about the SP to the IdP. Using a CA is much more complex and involves proprietary metadata extensions, but you still have to put it in metadata. Before you waste time on that, ignore the CA and supply the key directly in metadata first.

-- Scott