On 3/30/17, 12:27 PM, "users on behalf of José Ramalho" <users-bounces at shibboleth.net on behalf of jramalho at ua.pt> wrote: > I would appreciate some help to find the problem. Your IdP does not have the private half of the key pair the SP used to encrypt part of the message, which comes from the metadata. So the IdP's metadata is apparently wrong. -- Scott