Wrong KeyInfo in ArtifactResponse from IdP causing SSO to fail

[Cantor, Scott]

> Then looking at the Idp side logged protocol message I notice that the
> KeyInfo in the ArtifactResponse message is for the key used by my SP to
> earlier send the corresponding ArtifactResolve request message. Should the
> IdP ArtifactResponse message not be using the KeyInfo for the IdP's key
> instead of the KeyInfo of the SP's key?

You're confusing signatues with encryption. There's nothing wrong with the response, and there won't be a signature in general for a SOAP exchange over TLS.

I don't know why you're using artifacts, but if you don't want encryption you can turn it off. I don't know if setting it to conditional affects behavior using artifacts or not.

-- Scott