IdP version2 to IdP version 3

[Hall, Gerry]

I  currently have IdP version 2.4.4 installed in our production environment.  I want to move to IdP version 3.1.1.  However, rather than doing an upgrade to IdP version 2, I want to do a clean version 3.1.1 install and use the configuration files from version 2.4.4, making any changes as needed.  At this point in a test environment, I have made the changes to the ldap.properties file, the attribute-filter.xml file, the attribute-resolver.xml file, the relying-party.xml file and the metadata-provider.xml.  The v3 IdP loads and authenticates as expected and using a test SP, I can access the protected resource.

The issue that I am running into however is that if when I replace the test IdP metadata with the actual v2 PROD IdP metadata and when I add the actual v2 PROD IdP metadata to the test SP (using filesystem metadata provider), I get an error after authentication on the SP.  In other words, the authentication from the IdP appears to work, but the SP throws the following error:  Message was signed, but signature could not be verified.
Also, the SP logs have the following:  2015-10-09 09:45:16 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [3]: unable to verify message signature with supplied trust engine

In troubleshooting, I have verified that the SP is indeed using the metadata from the current v2 PROD IdP and that I have replaced the metadata in the metadata directory on the test v3 IdP with the metadata from the current PROD v2 IdP.  Thus, the fix on the NativeSPTroubleshootingCommonErrors page does not appear to be relevant in this case.

I am fairly certain that it has to do with a mismatch between the certs and keys in the credentials directory as created for IdP version 3 (could be wrong of course).

So my questions are:
1.  How do the IdP version 2 credential files relate to the IdP version 3 credential files (if at all)?

2.  Is this method of doing a clean version 3 install and then porting over the files from version 2 possible?  That is doing a clean install of IdP v3 and then copying over and changing the necessary IdPv2 files for IdPv3.

3.  I have looked for DOC's regarding this scenario but I only see DOC's for upgrading from version 2 or installing IdP v3 from scratch.  Can someone point me to DOC's that apply to my particular scenario?




________________________________

This e-mail message (including any attachments) is for the sole use of
the intended recipient(s) and may contain confidential and privileged
information. If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination, distribution
or copying of this message (including any attachments) is strictly
prohibited.

If you have received this message in error, please contact
the sender by reply e-mail message and destroy all copies of the
original message (including attachments).
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151009/4fa9cdc5/attachment.html>