IdP v3 alpha 3: Message was signed, but signature could not be verified.

[Gary Gwin]

I'm working with an internal Shib IdP to Shib SP test configuration, 
where I've upgraded a working production configuration to try Shib IdP 
v3 alpha 3. I'm getting the above error message for SP-initiated SSO. On 
the IdP, the request is handled:

15:41:23.717 - INFO [Shibboleth-Audit:1028] - 
20141031T214123Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_b41864ff7a3d002435082760101b10b3|https://sp.cafesoft.com/shibboleth|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://idp.cafesoft.org/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_fa0248f8b503cf47423f2eb6850890d1|goober@cafesoft.com|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|eduPersonAffiliation,principal,transientId,eduPersonEntitlement,idpCredential,idpName,|_5875354d6b4f139d67f0533c4d97b510||

On the SP, not:

2014-10-31 15:35:23 INFO Shibboleth-TRANSACTION [1]: Cached the 
following attributes with session (ID: ) for (applicationId: default) {
2014-10-31 15:35:23 INFO Shibboleth-TRANSACTION [1]: }
2014-10-31 15:41:23 INFO Shibboleth-TRANSACTION [1]: New session (ID: ) 
with (applicationId: default) for principal from (IdP: 
https://idp.cafesoft.org/idp/shibboleth) at (ClientAddress: 
192.168.2.100) with (NameIdentifier: none) using (Protocol: 
urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: )
2014-10-31 15:41:23 INFO Shibboleth-TRANSACTION [1]: Cached the 
following attributes with session (ID: ) for (applicationId: default) {
2014-10-31 15:41:23 INFO Shibboleth-TRANSACTION [1]: }

I've tried re-importing the IdP metadata to the SP, so that's not the 
issue. When I change the IdP to not sign the response, I get:

   Unable to establish security of incoming assertion.

Any ideas?

On a positive note, RemoteUser authn is working for me now, but wasn't 
with alpha 2.

Thanks,

Gary

-- 

Cafesoft
http://www.cafesoft.com

*****************************************************************
*                                                               *
*  Cams is a web single sign-on software solution for Apache,   *
*  IIS, WebLogic, WebSphere, JBoss and Tomcat web servers.      *
*                                                               *
*****************************************************************