SP Error: Message was signed, but signature could not be verified

[Nate Klingenstein]

1)  Assertion signing is disabled on both the IdP and SP so I don't know why
the SP is even checking the signature right now

The response(as opposed to the assertion) might be getting signed too.  Have you looked at the inbound assertion to inspect for signatures?  The SP will log the response and the decrypted assertion with shibd.logger on DEBUG.

2)  It actually works within the network the IdP and SP reside on, but when
accessed from an external network it throws this error.

My guess would be the IdP's are using different signature keys, and a user is being assigned to an IdP based on network location.

But yes, I agree, this is probably an IdP problem.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130603/c728c572/attachment-0001.html