Error on signing outbound SAML message

[Cantor, Scott]

Fundamentally, you can't be using default algorithms. Either the encryption algorithm(s) were changed from the defaults, or there has to be SP metadata containing extension elements that are causing it to switch to some algorithm that's triggering a bug.

We need to see the XML produced by the encryption step before it tries to sign the response. I don't know if that's even possible, so I would switch things and turn off response signing so that it logs the final output it sends to the SP. That might provide a hint about what it's doing that's not routine.

I would like to see the metadata as well.

-- Scott