TestShib metadata issues?

[Nate Klingenstein]

I'm certain it doesn't have just PKIX given that every Shibboleth SP is
self-signed out of the box, but I did check.

    <security:TrustEngine id="shibboleth.SignatureTrustEngine"
xsi:type="security:SignatureChaining">
        <security:TrustEngine
id="shibboleth.SignatureMetadataExplicitKeyTrustEngine"
xsi:type="security:MetadataExplicitKeySignature"
metadataProviderRef="ShibbolethMetadata"/>
        <security:TrustEngine
id="shibboleth.SignatureMetadataPKIXTrustEngine"
xsi:type="security:MetadataPKIXSignature"
metadataProviderRef="ShibbolethMetadata"/>
    </security:TrustEngine>

    <security:SecurityPolicy id="shibboleth.SAML2SSOSecurityPolicy"
xsi:type="security:SecurityPolicyType">
        <security:Rule xsi:type="samlsec:Replay"/>
        <security:Rule xsi:type="samlsec:IssueInstant"/>
        <security:Rule xsi:type="samlsec:SAML2AuthnRequestsSigned"/>
        <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature"
trustEngineRef="shibboleth.SignatureTrustEngine"/>
        <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign"
trustEngineRef="shibboleth.SignatureTrustEngine"/>
        <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign"
trustEngineRef="shibboleth.SignatureTrustEngine"/>
        <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
    </security:SecurityPolicy>

I'm ready to increase the log level for you.  Please ping off list when
you're ready.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180427/99ea524c/attachment.html>