"SAML response signature is not valid. "

[Cantor, Scott]

On 3/1/17, 11:32 AM, "users on behalf of Tom Poage" <users-bounces at shibboleth.net on behalf of tfpoage at ucdavis.edu> wrote:

>> On Mar 1, 2017, at 6:13 AM, Tom Scavo <trscavo at gmail.com> wrote:
>> In any case, you should always pass your metadata to SPs by reference,
>> never by value.
>
>Always first choice. With vendors, it's rarely possible.

And possibly very risky, you have no idea what they're doing with it or whether they're doing anything to verify it. Manually is at least clear and the implications are clear. I rarely, if ever, provide metadata in any ongoing fashion apart from via InCommon or on-campus via my own source.

Bear in mind that the risk of acquiring metadata from a vendor is not that high in relative terms but the risk of a vendor badly acquiring the IdP's and doing it insecurely is a data breach of quite likely the campus' own data.

-- Scott