Veoci Integration

[Klingenstein, Nate]

I'm trying to integrate a Shibboleth 3.3 IdP with a Spring Security SAML SP implementation.  There are signed requests and three certificates in their metadata, which I can control locally.  Two are marked for signature and one is marked for encryption.

If I turn off signed authentication requests in their metadata and spoof a request, it can't locate an encryption key.

https://stage.veoci.com/veoci/saml/login?idp=https://idp-co.calstate.edu/idp/shibboleth
https://idp-co.calstate.edu/idp/profile/SAML2/Unsolicited/SSO?providerId=https://stage.veoci.com/sp

If I tell it that encryption is optional, doctor their metadata, and use the unsolicited endpoint, a message is actually dispatched and parsed.

This feels like signature validation is just failing, but if anyone has experience, let me know.