Problem to download signed metadata from keycloak.

[Joakim Westlund]

Hi.

I have problem to download metadata from Keycloak to Shibboleth SP.

The problem I see is that Keycloak's Java XML signature library uses dsig: as
the namespace prefix (<dsig:Signature xmlns:dsig="
http://www.w3.org/2000/09/xmldsig#">), All other IdPs I have worked with
use ds: as the namespace prefix.

I don’t think Keycloak is doing anything wrong here, both ds: and dsig: should
work if I’m not mistaken. But Shibboleth SP 3.5.2 fails to validate
Keycloak's metadata signature with: "CredentialResolver did not supply any
candidate keys"


/ Joakim
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260515/72a178e3/attachment.htm>