<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Wavyne,<div><br></div><div><div><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><span class="Apple-style-span" style="font-family: 'Segoe UI'; font-size: 13px; "><div>It appears that our metadata cert doesn't match the SAML assertion cert that is being transmitted. Can something explain why this has occurred and what can be done to fix it?</div></span></span></blockquote><br></div><div>You can check the certificate that is being used by the IdP by looking at the certificate subelement of <security:Credential id="IdPCredential" xsi:type="security:X509Filesystem"> in relying-party.xml. You'll need to compare that certificate to the one in the metadata file you supplied to the PingFederate SP. You can make sure they match by updating one, the other, or both.</div></div><div><br></div><div>Let us know if we can help further,</div><div>Nate.</div></body></html>