Spring SAML SP Can't Recognize IdP Certificate (Signature Validation Failed)

[nduan at dtechspace.com]

I am trying to get the Spring Security SAML example connected with 
Shibboleth IdP 2.4.0.  For some reason, the spring SAML SP always uses 
its own cert to validate the signature in the IdP auth response message. 
I had to configure both the SP and the IdP to use the same cert to get 
the SSO to work finally.  The detailed error and the SP configuration 
are posted on Spring Forum at 
http://forum.spring.io/forum/spring-projects/security/saml/744933-service-provider-can-t-recognize-idp-certificate-signature-validation-failed.

If I am not mistaking, the authentication assertion in Authn response 
message shall be signed by the IdP using its private key, and the SP 
would use IdP's public key, which is available in the IdP's metadata 
accessible by the SP, to verify the signature.  Am I missing some 
configuration parameters in either SP or IdP to enable SP to pick the 
right public key?

Thanks!

ND