unsigned authN requests

[David Bantz]

On Wed, 5 Jun 2013, at 15:40 , "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> ... there's no way the request could be
> unsigned if you're getting that error. That means it's signed and not
> verifiable (or something else is wrong with it).

I stand corrected.  Trying the authN again and examining the debug logs,
it does appear the IdP thinks the request is signed as Scott correctly inferred:
...
15:51:40.645 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:308] - Checking child metadata provider for entity descriptor with entity ID: https://demo.docusign.net
15:51:40.646 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:518] - Searching for entity descriptor with an entity ID of https://demo.docusign.net
15:51:40.646 - DEBUG [org.opensaml.security.MetadataCredentialResolver:348] - Added new credential collection to cache with key: [https://demo.docusign.net,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,SIGNING]
15:51:40.646 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:74] - Registry located evaluable criteria class org.opensaml.xml.security.credential.criteria.EvaluableKeyAlgorithmCredentialCriteria for criteria class org.opensaml.xml.security.criteria.KeyAlgorithmCriteria
15:51:40.646 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:105] - Registry could not locate evaluable criteria for criteria class org.opensaml.security.MetadataCriteria
15:51:40.647 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:74] - Registry located evaluable criteria class org.opensaml.xml.security.credential.criteria.EvaluableEntityIDCredentialCriteria for criteria class org.opensaml.xml.security.criteria.EntityIDCriteria
15:51:40.647 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:74] - Registry located evaluable criteria class org.opensaml.xml.security.credential.criteria.EvaluableUsageCredentialCriteria for criteria class org.opensaml.xml.security.criteria.UsageCriteria
15:51:40.647 - DEBUG [org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine:154] - Attempting to verify signature using trusted credentials
15:51:40.647 - DEBUG [org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine:162] - Failed to verify signature using either supplied candidate credential or directly trusted credentials
15:51:40.647 - DEBUG [org.opensaml.xml.signature.impl.PKIXSignatureTrustEngine:171] - Candidate credential was either not supplied or did not contain verification key
15:51:40.648 - DEBUG [org.opensaml.xml.signature.impl.PKIXSignatureTrustEngine:172] - PKIX trust engine requires supplied key, skipping PKIX trust evaluation
15:51:40.648 - WARN [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:195] - Simple signature validation (with no request-derived credentials) failed
15:51:40.648 - WARN [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:138] - Validation of request simple signature failed for context issuer: https://demo.docusign.net
15:51:40.649 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:377] - Message did not meet security requirements
…

So possibly it was signed using a different certificate than in the metadata I imported?  
Other common/likely/obvious ways to trigger this?

David Bantz