Problem to download signed metadata from keycloak.

[Scott Cantor]

The problem is there's a KeyName in there that's throwing off the logic that the SP library pulls keys with.

You'd have to go to a different syntax to configure the validation certificate, by embedding a CredentialResolver element inside the filter instead of the shorthand of a certificate XML attribute, and that allows a keyName to be set for the certificate that matches whatever it's putting in the KeyInfo block.

All the supported options are documented in the wiki.

It doesn't come up often (like never) because KeyName isn't used very often in such metadata.

-- Scott