Message was signed, but signature could not be verified.

[Nate Klingenstein]

Arthur,

Yes.  You can check the certificate embedded in the SAML response and compare it to what is in metadata for a sanity check on your end, but they're almost certainly signing with a key that doesn't match the certificate that you have in their metadata.  This is probably theirs to solve, either by fixing the keypair they're using or by fixing the metadata they've supplied to you.

Take care,
Nate

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id