Signature trust could not be established via PKIX validation of signing credential

[Cantor, Scott]

> I promise I'm not crazy.  I had the SP generate a new self-signed certificate,
> just to see if somehow something got corrupted or copied wrong in the
> metadata or request.  Same error.  Here is what is in the metadata:

How is the metadata supplied to the IdP?

>         <X509SubjectName>CN=ip-0A420AEF</X509SubjectName>

Just for kicks, take that out.

> > You can certainly turn up org.opensaml and see what it tells you.
> >
> It was already at TRACE and the logs I pasted previously are all it gave me.

You have org.opensaml at DEBUG?

When I had logging up, I intentionally created a mismatch and see this stuff before any PKIX stuff gets involved. You can see the references to ExplicitKeySignatureTrustEngine, which is what has to be in there. If you don't see that, then somehow it's not enabled despite your configuration.

-- Scott

19:46:46.852 - 128.146.178.3 - DEBUG [org.opensaml.xml.signature.SignatureValidator:54] - Attempting to validate signature using key from supplied credential
19:46:46.852 - 128.146.178.3 - DEBUG [org.opensaml.xml.signature.SignatureValidator:90] - Creating XMLSignature object
19:46:46.852 - 128.146.178.3 - DEBUG [org.opensaml.xml.signature.SignatureValidator:64] - Validating signature with signature algorithm URI: http://www.w3.org/2000/09/xmldsig#rsa-sha1
19:46:46.853 - 128.146.178.3 - DEBUG [org.opensaml.xml.signature.SignatureValidator:65] - Validation credential key algorithm 'RSA', key instance class 'sun.security.rsa.RSAPublicKeyImpl'
19:46:46.854 - 128.146.178.3 - DEBUG [org.opensaml.xml.signature.SignatureValidator:70] - Signature validated with key from supplied credential
19:46:46.855 - 128.146.178.3 - DEBUG [org.opensaml.xml.signature.impl.BaseSignatureTrustEngine:148] - Signature validation using candidate credential was successful
19:46:46.855 - 128.146.178.3 - DEBUG [org.opensaml.xml.signature.impl.BaseSignatureTrustEngine:101] - Successfully verified signature using KeyInfo-derived credential
19:46:46.856 - 128.146.178.3 - DEBUG [org.opensaml.xml.signature.impl.BaseSignatureTrustEngine:102] - Attempting to establish trust of KeyInfo-derived credential
19:46:46.857 - 128.146.178.3 - DEBUG [org.opensaml.xml.signature.impl.BaseSignatureTrustEngine:107] - Failed to establish trust of KeyInfo-derived credential
19:46:46.858 - 128.146.178.3 - DEBUG [org.opensaml.xml.signature.impl.BaseSignatureTrustEngine:115] - Failed to verify signature and/or establish trust using any KeyInfo-derived credentials
19:46:46.858 - 128.146.178.3 - DEBUG [org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine:107] - Attempting to verify signature using trusted credentials
19:46:46.858 - 128.146.178.3 - DEBUG [org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine:115] - Failed to verify signature using either KeyInfo-derived or directly trusted credentials