ExplicitKey TrustEngine KeyName mismatch issue

[er re]

Hello,

I am running a Shibboleth SP provided by the apt package
shibboleth-sp-utils version 3.4.1. on Ubuntu 24.04.

When my SP tries to verify incomming SAML assertions using the ExplicitKey
trust engine I run into this issue when the ds:KeyName is both present and
doesn't match the value specified in the federation metadata:

2026-01-29 01:11:58 DEBUG XMLTooling.CredentialCriteria [1] [default]:
credential name(s) didn't overlap
2026-01-29 01:11:58 DEBUG XMLTooling.TrustEngine.ExplicitKey [1]
[default]: unable to validate signature, no credentials available from peer

Most of the IdPs I'm working with just omit the key name, in which case
everything works fine and just the certificate is compared to the metadata.
However one IdP sends over a thumbprint as the key name which of course
doesn't match the string provided by the federation. I believe they are
using Keycloak as their IdP suit.

I verified that the issue occurs here by manually adjusting the key name in
a local copy of the federation supplied metadata to the value supplied by
the IdP, after which the trust engine was able to verify SAML assertions
and am now looking for a long term solution to this issue.

As per the information I received from the people in charge, both the
federation metadata and the IdP key name cannot be adjusted from their ends.
>From the documentation and the information I got from the person who runs
the IdP with which I run into this issue, it is my understanding that the
key name should be irrelevant for the ExplicitTrust trust engine.

For that reason I'm wondering if the key name matching is indeed intended
behavior for the trust engine and if so whether there is a solution that
can be implemented on the SP side.

Any help would be greatly appreciated!

Best Regards
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260130/b4604999/attachment.htm>