Spring SAML SP Can't Recognize IdP Certificate (Signature Validation Failed)

[Cantor, Scott]

On 2/14/14, 1:48 AM, "Nick Duan" <nduan at dtechspace.com> wrote:
>
>Another option to make it to work is let IdP not to sign the assertion in
>the SSO response.   I configured the Spring Security SP to set the
>metadata
>parameter "wantAssertionSigned" to false.    Apparently Shibboleth IdP
>ignored that part and kept signing the authentication assertion.   Any
>ideas
>on how to make the IdP recognize the SP's request not wanting assertion to
>be signed?

I don't see how it matters, you're going to have to sign the Response
anyway.

The SP can't force the IdP not to sign, it can hint so that if it's
configured to be optional, the IdP can choose not to.

-- Scott