Help ? Non-federation, custom meta-data ?

[Cantor, Scott]

> We have a new SAS Service provider HireVue. They seem to be able to do
> either SP initiated or IDP initiated login.
> I managed to get their meta-data to seem to work for the IDP initiated login,
> but the SP initiated is pretty confusing
> to me.. It looks like it tries to add meta-data on the fly ?

I doubt they even use metadata, so I'm not sure what you mean by that.

> In any case I get the
> following error:
> 
>  Message did not meet security requirements
> org.opensaml.ws.security.SecurityPolicyException: Validation of protocol
> message signature failed

That just means they signed the request (which is unnecessary in most cases) and the metadata you loaded didn't contain the proper key.

If you weren't encrypting anything in the IdP-initiated case, then the metadata you loaded wouldn't have had to contain a key for them at all, which would explain why it doesn't work in the other case.

-- Scott