signature not found

[Tom Poage]

> On Jan 13, 2017, at 4:03 PM, Jeff McCullough <jeffmc at berkeley.edu> wrote:
> 
> Hi Tom,
> 
> It happens to be Kronos. Can you possibly show me the details of your override?

Here's what we ended up with:

    <util:list id="shibboleth.RelyingPartyOverrides">
...
        <bean parent="RelyingPartyByName" c:relyingPartyIds="#{{'https://...-dev.kronos.net','https://....kronos.net'}}">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO"
                          p:encryptAssertions="false"
                          p:signAssertions="true"
                          p:signResponses="false"/>
                </list>
             </property>
        </bean>
    </util:list>

We spent almost two months going back and forth with them before we figured it out (last Nov). I'd hope they'd have integrated this information into their SoP. Guess not.

And you likely know they only support IdP-initated SSO, so a launch URL needs to be hosted somewhere.

Tom.