> The problem I see is that Keycloak's Java XML signature library uses dsig: as the namespace > prefix (<dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig">), All other IdPs > have worked with use ds: as the namespace prefix. This seems infeasible, but stranger things have happened. What do the logs say?