New SP Setup

[Tom Scavo]

On Thu, Dec 28, 2017 at 1:47 PM, Myers, Kevin R (Mutual Funds
Technology Svcs) <kevin.myers at hartfordfunds.com> wrote:
>
> Now the response is failing signature validation.
>
> The second message states “keys didn’t match”. Is this just comparing the
> public cert in the metadata to the one in the response.

The cert embedded in the signature is just a hint. The consumer may
use it to cherry-pick one of multiple signing certs in IdP metadata.
Alternatively, the consumer may simply cycle through the signing certs
in IdP metadata. Usually there is just one signing cert in IdP
metadata, so the hint isn't a huge help.

> They look to be the same to us.

You don't have to guess. You can compare the cert content using a tool
like openssl.

> Can someone help point us to something specific that may be wrong in our
> config (or theirs)?

If the cert in the response matches the cert in IdP metadata, and
verification fails, then the SP is not consuming the metadata you
think it is.

Tom