New SP Setup

[Myers, Kevin R (Mutual Funds Technology Svcs)]

Hi, I have questions related to setting up an SP with Shib to integrate with an external partner IDP (they are using ADFS, but not sure that matters).
We initially had issues with the AudienceRestriction, and had them update their relying party id to our entityid.
Now the response is failing signature validation.

The second message states "keys didn't match". Is this just comparing the public cert in the metadata to the one in the response. They look to be the same to us.
Can someone help point us to something specific that may be wrong in our config (or theirs)?

FYI. This IDP shares the same metadata with many partners, so I'm inclined to think the problem is with our config, but we just don't see it.


OpenSAML.SecurityPolicyRule.XMLSigning [9]: validating signature profile

XMLTooling.CredentialCriteria [9]: keys didn't match

XMLTooling.TrustEngine.ExplicitKey [9]: attempting to validate signature with the peer's credentials

XMLTooling.TrustEngine.ExplicitKey [9]: public key did not validate signature: Digital signature does not validate with the supplied key.

XMLTooling.TrustEngine.ExplicitKey [9]: no peer credentials validated the signature

XMLTooling.TrustEngine.PKIX [9]: validating signature using certificate from within the signature

XMLTooling.TrustEngine.PKIX [9]: Digital signature does not validate with the supplied key.

XMLTooling.TrustEngine.PKIX [9]: failed to verify signature with embedded certificates

OpenSAML.SecurityPolicyRule.XMLSigning [9]: unable to verify message signature with supplied trust engine

Shibboleth.SSO.SAML2 [9]: detected a problem with assertion: Message was signed, but signature could not be verified.

************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information.  If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited.  If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171228/c44be587/attachment-0001.html>