SHA1 signed authn request issue

[Cantor, Scott]

> The metadata file is shared between IdP v3.2 and v3.3 so it shouldn't be a
> metadata issue.

That's the only likely problem that fits the error. Even using a different Java version doesn't exactly fit, but that would be the sort of thing I'd probably point to otherwise.

The unusual aspect of it falling into the name checking step and failing there suggests this has to be a POST binding request, not a redirect. For the certificate to be seen, it must be getting it via the message, so that means POST.

The signature must be validating with the key in the message, but it must not match the SP's metadata, at which point it starts trying to path validate and then tries to validate the name in the certificate. That's all just noise, nobody's using PKIX and it's simply not able to match the key against the metadata, so that has to be the real problem.

> Unsolicited authentication works fine.

Because the problem is in the request.

-- Scott