<div dir="ltr"><div>Hi, </div><div><br></div><div>I&#39;m configuring Shib as the IDP and Spring-saml as the SP (spring-saml web site: <a href="http://spring-saml.sourceforge.net/">http://spring-saml.sourceforge.net/</a>) but I&#39;m having problems with the AuthRequest message. </div><div><br></div><div>These are my IDP&#39;s configuration files:</div><div><br></div><div><b>Relying Party (Part of the File):</b></div><div><br></div><div> ...    </div><div>    &lt;/rp:DefaultRelyingParty&gt;</div><div><br></div><div>    &lt;rp:RelyingParty id=&quot;sp_dms&quot; provider=&quot;<a href="http://idp.example.org/idp/shibboleth">http://idp.example.org/idp/shibboleth</a>&quot; defaultSigningCredentialRef=&quot;IdPCredential&quot;&gt;</div><div><br></div><div>        &lt;rp:ProfileConfiguration xsi:type=&quot;saml:SAML2SSOProfile&quot; encryptAssertions=&quot;never&quot; encryptNameIds=&quot;never&quot;/&gt;</div><div><br></div><div>    &lt;/rp:RelyingParty&gt;</div><div><br></div><div>    &lt;metadata:MetadataProvider id=&quot;ShibbolethMetadata&quot; xsi:type=&quot;metadata:ChainingMetadataProvider&quot;&gt;</div><div><br></div><div>        &lt;!-- Load the IdP&#39;s own metadata.  This is necessary for artifact support. --&gt;</div><div>        &lt;metadata:MetadataProvider id=&quot;IdPMD&quot; xsi:type=&quot;metadata:FilesystemMetadataProvider&quot;</div><div>                                   metadataFile=&quot;/opt/shibboleth-idp/metadata/idp-metadata.xml&quot;</div><div>                                   maxRefreshDelay=&quot;P1D&quot; /&gt;</div><div><br></div><div>        &lt;metadata:MetadataProvider id=&quot;<a href="http://met.for.sp.net">met.for.sp.net</a>&quot; xsi:type=&quot;metadata:FilesystemMetadataProvider&quot; metadataFile=&quot;/opt/shibboleth-idp/metadata/sp1-metadata.xml&quot; maxRefreshDelay=&quot;P1D&quot; /&gt;</div><div>   ...</div><div><br></div><div><b>SP&#39;s Metadata (Complete File):</b></div><div><br></div><div>&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;</div><div>&lt;md:EntityDescriptor entityID=&quot;sp_dms&quot; xmlns:md=&quot;urn:oasis:names:tc:SAML:2.0:metadata&quot; validUntil=&quot;2050-01-01T00:00:00Z&quot;&gt;</div><div>    &lt;md:SPSSODescriptor protocolSupportEnumeration=&quot;urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol&quot;&gt;</div><div><br></div><div>        &lt;ds:KeyInfo xmlns:ds=&quot;<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>&quot;&gt;</div><div>                &lt;ds:X509Data&gt;</div><div>                        &lt;ds:X509Certificate&gt;</div><div>                                MIICXTCCAcag...</div><div>                        &lt;/ds:X509Certificate&gt;</div><div>                &lt;/ds:X509Data&gt;</div><div>        &lt;/ds:KeyInfo&gt;</div><div><br></div><div>        &lt;md:NameIDFormat&gt;urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified&lt;/md:NameIDFormat&gt;</div><div>        &lt;md:AssertionConsumerService index=&quot;1&quot; Binding=&quot;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST&quot; Location=&quot;<a href="https://dmsqa.easysol.net:7443/portal/sp/AssertionConsumerService">https://dmsqa.easysol.net:7443/portal/sp/AssertionConsumerService</a>&quot;/&gt;</div><div>    &lt;/md:SPSSODescriptor&gt;</div><div>&lt;/md:EntityDescriptor&gt;</div><div><br></div><div><br></div><div><b>Attribute-Filter (Complete File):</b></div><div><br></div><div>&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;</div><div><br></div><div>&lt;afp:AttributeFilterPolicyGroup id=&quot;ShibbolethFilterPolicy&quot;</div><div>                                xmlns:afp=&quot;urn:mace:shibboleth:2.0:afp&quot; xmlns:basic=&quot;urn:mace:shibboleth:2.0:afp:mf:basic&quot; </div><div>                                xmlns:saml=&quot;urn:mace:shibboleth:2.0:afp:mf:saml&quot; xmlns:xsi=&quot;<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>&quot; </div><div>                                xsi:schemaLocation=&quot;urn:mace:shibboleth:2.0:afp classpath:/schema/shibboleth-2.0-afp.xsd</div><div>                                                    urn:mace:shibboleth:2.0:afp:mf:basic classpath:/schema/shibboleth-2.0-afp-mf-basic.xsd</div><div>                                                    urn:mace:shibboleth:2.0:afp:mf:saml classpath:/schema/shibboleth-2.0-afp-mf-saml.xsd&quot;&gt;</div><div><br></div><div>    &lt;afp:AttributeFilterPolicy id=&quot;releaseTransientIdToAnyone&quot;&gt;</div><div>        &lt;afp:PolicyRequirementRule xsi:type=&quot;basic:ANY&quot;/&gt;</div><div><br></div><div>        &lt;afp:AttributeRule attributeID=&quot;transientId&quot;&gt;</div><div>            &lt;afp:PermitValueRule xsi:type=&quot;basic:ANY&quot;/&gt;</div><div>        &lt;/afp:AttributeRule&gt;</div><div><br></div><div>    &lt;/afp:AttributeFilterPolicy&gt;</div><div><br></div><div>&lt;/afp:AttributeFilterPolicyGroup&gt;</div><div><br></div><div><br></div><div><b>Attribute-Resolver (Complete File):</b></div><div><br></div><div>&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;</div><div><br></div><div>&lt;resolver:AttributeResolver xmlns:resolver=&quot;urn:mace:shibboleth:2.0:resolver&quot; xmlns:xsi=&quot;<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>&quot; </div><div>                            xmlns:pc=&quot;urn:mace:shibboleth:2.0:resolver:pc&quot; xmlns:ad=&quot;urn:mace:shibboleth:2.0:resolver:ad&quot; </div><div>                            xmlns:dc=&quot;urn:mace:shibboleth:2.0:resolver:dc&quot; xmlns:enc=&quot;urn:mace:shibboleth:2.0:attribute:encoder&quot; </div><div>                            xmlns:sec=&quot;urn:mace:shibboleth:2.0:security&quot; </div><div>                            xsi:schemaLocation=&quot;urn:mace:shibboleth:2.0:resolver classpath:/schema/shibboleth-2.0-attribute-resolver.xsd</div><div>                                               urn:mace:shibboleth:2.0:resolver:pc classpath:/schema/shibboleth-2.0-attribute-resolver-pc.xsd</div><div>                                               urn:mace:shibboleth:2.0:resolver:ad classpath:/schema/shibboleth-2.0-attribute-resolver-ad.xsd</div><div>                                               urn:mace:shibboleth:2.0:resolver:dc classpath:/schema/shibboleth-2.0-attribute-resolver-dc.xsd</div><div>                                               urn:mace:shibboleth:2.0:attribute:encoder classpath:/schema/shibboleth-2.0-attribute-encoder.xsd</div><div>                                               urn:mace:shibboleth:2.0:security classpath:/schema/shibboleth-2.0-security.xsd&quot;&gt;</div><div><br></div><div>    &lt;!-- Name Identifier related attributes --&gt;</div><div>    &lt;resolver:AttributeDefinition id=&quot;transientId&quot; xsi:type=&quot;ad:TransientId&quot;&gt;</div><div>        &lt;resolver:AttributeEncoder xsi:type=&quot;enc:SAML1StringNameIdentifier&quot; nameFormat=&quot;urn:mace:shibboleth:1.0:nameIdentifier&quot;/&gt;</div><div>        &lt;resolver:AttributeEncoder xsi:type=&quot;enc:SAML2StringNameID&quot; nameFormat=&quot;urn:oasis:names:tc:SAML:2.0:nameid-format:transient&quot;/&gt;</div><div>    &lt;/resolver:AttributeDefinition&gt;</div><div><br></div><div>    &lt;resolver:PrincipalConnector xsi:type=&quot;pc:Transient&quot; id=&quot;shibTransient&quot; nameIDFormat=&quot;urn:mace:shibboleth:1.0:nameIdentifier&quot;/&gt;</div><div>    &lt;resolver:PrincipalConnector xsi:type=&quot;pc:Transient&quot; id=&quot;saml1Unspec&quot; nameIDFormat=&quot;urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified&quot;/&gt;</div><div>    &lt;resolver:PrincipalConnector xsi:type=&quot;pc:Transient&quot; id=&quot;saml2Transient&quot; nameIDFormat=&quot;urn:oasis:names:tc:SAML:2.0:nameid-format:transient&quot;/&gt;</div><div><br></div><div>&lt;/resolver:AttributeResolver&gt;</div><div><br></div><div><br></div><div>Here&#39;s the log:</div><div>...</div><div>18:20:20.159 - DEBUG [org.opensaml.ws.message.decoder.BaseMessageDecoder:205] - Message succesfully unmarshalled</div><div>18:20:20.159 - DEBUG [org.opensaml.saml2.binding.decoding.HTTPPostDecoder:94] - Decoded SAML message</div><div>18:20:20.159 - DEBUG [org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder:112] - Extracting ID, issuer and issue instant from request</div><div>18:20:20.159 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] - Checking child metadata provider for entity descriptor with entity ID: sp_dms</div><div>18:20:20.160 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] - Searching for entity descriptor with an entity ID of sp_dms</div><div>18:20:20.160 - TRACE [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:533] - Metadata root is an entity descriptor, checking if it&#39;s the one we&#39;re looking for.</div><div>18:20:20.160 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:167] - Metadata document does not contain an EntityDescriptor with the ID sp_dms</div><div>18:20:20.160 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] - Checking child metadata provider for entity descriptor with entity ID: sp_dms</div><div>18:20:20.160 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] - Searching for entity descriptor with an entity ID of sp_dms</div><div>18:20:20.160 - TRACE [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:524] - Entity descriptor for the ID sp_dms was found in index cache, returning</div><div>18:20:20.161 - DEBUG [PROTOCOL_MESSAGE:113] - </div><div>&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;&lt;saml2p:AuthnRequest xmlns:saml2p=&quot;urn:oasis:names:tc:SAML:2.0:protocol&quot; AssertionConsumerServiceURL=&quot;<a href="http://domain/sp/AssertionConsumerServicePath">http://domain/sp/AssertionConsumerServicePath</a>&quot; Destination=&quot;<a href="http://idp.example.org/idp/profile/SAML2/POST/SSO">http://idp.example.org/idp/profile/SAML2/POST/SSO</a>&quot; ID=&quot;7a092b8d-6e4e-46aa-bf8c-1bdf54799220&quot; IssueInstant=&quot;2014-09-06T23:20:19.860Z&quot; Version=&quot;2.0&quot;&gt;</div><div>   &lt;saml2:Issuer xmlns:saml2=&quot;urn:oasis:names:tc:SAML:2.0:assertion&quot; Format=&quot;urn:oasis:names:tc:SAML:2.0:nameid-format:entity&quot;&gt;sp_dms&lt;/saml2:Issuer&gt;</div><div>   &lt;ds:Signature xmlns:ds=&quot;<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>&quot;&gt;</div><div>      &lt;ds:SignedInfo&gt;</div><div>         &lt;ds:CanonicalizationMethod Algorithm=&quot;<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>&quot;/&gt;</div><div>         &lt;ds:SignatureMethod Algorithm=&quot;<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>&quot;/&gt;</div><div>         &lt;ds:Reference URI=&quot;#7a092b8d-6e4e-46aa-bf8c-1bdf54799220&quot;&gt;</div><div>            &lt;ds:Transforms&gt;</div><div>               &lt;ds:Transform Algorithm=&quot;<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>&quot;/&gt;</div><div>               &lt;ds:Transform Algorithm=&quot;<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>&quot;/&gt;</div><div>            &lt;/ds:Transforms&gt;</div><div>            &lt;ds:DigestMethod Algorithm=&quot;<a href="http://www.w3.org/2000/09/xmldsig#sha1">http://www.w3.org/2000/09/xmldsig#sha1</a>&quot;/&gt;</div><div>            &lt;ds:DigestValue&gt;D2HrzVmrGp...=&lt;/ds:DigestValue&gt;</div><div>         &lt;/ds:Reference&gt;</div><div>      &lt;/ds:SignedInfo&gt;</div><div>      &lt;ds:SignatureValue&gt;inMstvKI061xF...&lt;/ds:SignatureValue&gt;</div><div>      &lt;ds:KeyInfo&gt;</div><div>         &lt;ds:X509Data&gt;</div><div>            &lt;ds:X509Certificate&gt;MIICXTCCAcagAwIBAg...&lt;/ds:X509Certificate&gt;</div><div>         &lt;/ds:X509Data&gt;</div><div>      &lt;/ds:KeyInfo&gt;</div><div>   &lt;/ds:Signature&gt;</div><div>&lt;/saml2p:AuthnRequest&gt;</div><div><br></div><div>18:20:20.162 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128] - Looking up relying party configuration for sp_dms</div><div>18:20:20.163 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:130] - Custom relying party configuration found for sp_dms</div><div>18:20:20.163 - DEBUG [org.opensaml.ws.message.decoder.BaseMessageDecoder:130] - Evaluating security policy of type &#39;edu.internet2.middleware.shibboleth.common.security.ShibbolethSecurityPolicy&#39; for decoded message</div><div>18:20:20.163 - DEBUG [org.opensaml.util.storage.ReplayCache:92] - Attempting to acquire lock for replay cache check</div><div>18:20:20.163 - DEBUG [org.opensaml.util.storage.ReplayCache:94] - Lock acquired</div><div>18:20:20.163 - DEBUG [org.opensaml.util.storage.ReplayCache:105] - Message ID 7a092b8d-6e4e-46aa-bf8c-1bdf54799220 was not a replay</div><div>18:20:20.164 - DEBUG [org.opensaml.util.storage.ReplayCache:132] - Writing message ID sp_dms7a092b8d-6e4e-46aa-bf8c-1bdf54799220 to replay cache with expiration time 2014-09-06T18:25:20.163-05:00</div><div>18:20:20.164 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:308] - Checking child metadata provider for entity descriptor with entity ID: sp_dms</div><div>18:20:20.164 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] - Searching for entity descriptor with an entity ID of sp_dms</div><div>18:20:20.164 - TRACE [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:533] - Metadata root is an entity descriptor, checking if it&#39;s the one we&#39;re looking for.</div><div>18:20:20.164 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:250] - Metadata document did not contain a descriptor for entity sp_dms</div><div>18:20:20.165 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:317] - Metadata document did not contain any role descriptors of type {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor for entity sp_dms</div><div>18:20:20.165 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:286] - Metadata document does not contain a role of type {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor supporting protocol urn:oasis:names:tc:SAML:2.0:protocol for entity sp_dms</div><div>18:20:20.165 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:308] - Checking child metadata provider for entity descriptor with entity ID: sp_dms</div><div>18:20:20.165 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] - Searching for entity descriptor with an entity ID of sp_dms</div><div>18:20:20.165 - TRACE [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:524] - Entity descriptor for the ID sp_dms was found in index cache, returning</div><div>18:20:20.165 - DEBUG [org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule:92] - SPSSODescriptor for entity ID &#39;sp_dms&#39; does not require AuthnRequests to be signed</div><div>18:20:20.166 - DEBUG [org.apache.xml.security.utils.ElementProxy:90] - setElement(&quot;ds:Reference&quot;, &quot;&quot;)</div><div>18:20:20.166 - DEBUG [org.apache.xml.security.utils.ElementProxy:90] - setElement(&quot;ds:Transforms&quot;, &quot;&quot;)</div><div>18:20:20.166 - DEBUG [org.apache.xml.security.utils.ElementProxy:90] - setElement(&quot;ds:Transform&quot;, &quot;&quot;)</div><div>18:20:20.166 - DEBUG [org.opensaml.security.SAMLSignatureProfileValidator:229] - Saw Enveloped signature transform</div><div>18:20:20.166 - DEBUG [org.apache.xml.security.utils.ElementProxy:90] - setElement(&quot;ds:Transform&quot;, &quot;&quot;)</div><div>18:20:20.167 - DEBUG [org.opensaml.security.SAMLSignatureProfileValidator:233] - Saw Exclusive C14N signature transform</div><div>18:20:20.167 - DEBUG [org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule:125] - Attempting to verify signature on signed SAML protocol message using context issuer message type: {urn:oasis:names:tc:SAML:2.0:protocol}AuthnRequest</div><div>18:20:20.167 - DEBUG [org.apache.xml.security.algorithms.JCEMapper:271] - Request for URI <a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a></div><div>18:20:20.167 - DEBUG [org.apache.xml.security.algorithms.JCEMapper:236] - Request for URI <a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a></div><div>18:20:20.167 - DEBUG [org.opensaml.security.MetadataCredentialResolver:167] - Forcing on-demand metadata provider refresh if necessary</div><div>18:20:20.168 - DEBUG [org.opensaml.security.MetadataCredentialResolver:215] - Attempting to retrieve credentials from cache using index: [sp_dms,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,SIGNING]</div><div>18:20:20.168 - TRACE [org.opensaml.security.MetadataCredentialResolver:218] - Read lock over cache acquired</div><div>18:20:20.168 - DEBUG [org.opensaml.security.MetadataCredentialResolver:223] - Retrieved credentials from cache using index: [sp_dms,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,SIGNING]</div><div>18:20:20.168 - TRACE [org.opensaml.security.MetadataCredentialResolver:229] - Read lock over cache released</div><div>18:20:20.169 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:105] - Registry could not locate evaluable criteria for criteria class org.opensaml.security.MetadataCriteria</div><div>...</div><div>18:20:20.196 - DEBUG [org.apache.xml.security.signature.Manifest:313] - verify 1 References</div><div>18:20:20.196 - DEBUG [org.apache.xml.security.signature.Manifest:314] - I am not requested to follow nested Manifests</div><div>18:20:20.196 - DEBUG [org.apache.xml.security.utils.ElementProxy:90] - setElement(&quot;ds:Reference&quot;, &quot;&quot;)</div><div>18:20:20.197 - DEBUG [org.apache.xml.security.utils.ElementProxy:90] - setElement(&quot;ds:Transforms&quot;, &quot;&quot;)</div><div>18:20:20.197 - DEBUG [org.apache.xml.security.algorithms.JCEMapper:219] - Request for URI <a href="http://www.w3.org/2000/09/xmldsig#sha1">http://www.w3.org/2000/09/xmldsig#sha1</a></div><div>18:20:20.197 - DEBUG [org.apache.xml.security.utils.resolver.ResourceResolver:165] - I was asked to create a ResourceResolver and got 0</div><div>18:20:20.197 - DEBUG [org.apache.xml.security.utils.resolver.ResourceResolver:108] - check resolvability by class org.apache.xml.security.utils.resolver.ResourceResolver</div><div>18:20:20.197 - DEBUG [org.apache.xml.security.utils.resolver.implementations.ResolverFragment:136] - State I can resolve reference: &quot;#7a092b8d-6e4e-46aa-bf8c-1bdf54799220&quot;</div><div>18:20:20.198 - DEBUG [org.apache.xml.security.utils.resolver.implementations.ResolverFragment:99] - Try to catch an Element with ID 7a092b8d-6e4e-46aa-bf8c-1bdf54799220 and Element was [saml2p:AuthnRequest: null]</div><div>18:20:20.198 - DEBUG [org.apache.xml.security.utils.ElementProxy:90] - setElement(&quot;ds:Transform&quot;, &quot;&quot;)</div><div>18:20:20.198 - DEBUG [org.apache.xml.security.transforms.Transforms:269] - Perform the (0)th <a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a> transform</div><div>18:20:20.198 - DEBUG [org.apache.xml.security.utils.ElementProxy:90] - setElement(&quot;ds:Transform&quot;, &quot;&quot;)</div><div>18:20:20.199 - DEBUG [org.apache.xml.security.utils.DigesterOutputStream:55] - Pre-digested input:</div><div>18:20:20.199 - DEBUG [org.apache.xml.security.utils.DigesterOutputStream:60] - &lt;saml2p:AuthnRequest xmlns:saml2p=&quot;urn:oasis:names:tc:SAML:2.0:protocol&quot; AssertionConsumerServiceURL=&quot;<a href="http://domain/sp/AssertionConsumerServicePath">http://domain/sp/AssertionConsumerServicePath</a>&quot; Destination=&quot;<a href="http://idp.example.org/idp/profile/SAML2/POST/SSO">http://idp.example.org/idp/profile/SAML2/POST/SSO</a>&quot; ID=&quot;7a092b8d-6e4e-46aa-bf8c-1bdf54799220&quot; IssueInstant=&quot;2014-09-06T23:20:19.860Z&quot; Version=&quot;2.0&quot;&gt;&lt;saml2:Issuer xmlns:saml2=&quot;urn:oasis:names:tc:SAML:2.0:assertion&quot; Format=&quot;urn:oasis:names:tc:SAML:2.0:nameid-format:entity&quot;&gt;sp_dms&lt;/saml2:Issuer&gt;&lt;/saml2p:AuthnRequest&gt;</div><div>18:20:20.199 - DEBUG [org.apache.xml.security.signature.Reference:784] - Verification successful for URI &quot;#7a092b8d-6e4e-46aa-bf8c-1bdf54799220&quot;</div><div>18:20:20.199 - DEBUG [org.apache.xml.security.signature.Manifest:344] - The Reference has Type </div><div>18:20:20.199 - DEBUG [org.opensaml.xml.signature.SignatureValidator:70] - Signature validated with key from supplied credential</div><div>18:20:20.199 - DEBUG [org.opensaml.xml.signature.impl.BaseSignatureTrustEngine:148] - Signature validation using candidate credential was successful</div><div>18:20:20.200 - DEBUG [org.opensaml.xml.signature.impl.BaseSignatureTrustEngine:101] - Successfully verified signature using KeyInfo-derived credential</div><div>18:20:20.200 - DEBUG [org.opensaml.xml.signature.impl.BaseSignatureTrustEngine:102] - Attempting to establish trust of KeyInfo-derived credential</div><div>18:20:20.200 - DEBUG [org.opensaml.xml.security.x509.BasicX509CredentialNameEvaluator:220] - Supplied trusted names are null or empty, skipping name evaluation</div><div>18:20:20.200 - DEBUG [org.opensaml.xml.signature.impl.PKIXSignatureTrustEngine:234] - Signature trust could not be established via PKIX validation of signing credential</div><div>18:20:20.200 - DEBUG [org.opensaml.xml.signature.impl.BaseSignatureTrustEngine:107] - Failed to establish trust of KeyInfo-derived credential</div><div>18:20:20.200 - DEBUG [org.opensaml.xml.signature.impl.BaseSignatureTrustEngine:115] - Failed to verify signature and/or establish trust using any KeyInfo-derived credentials</div><div>18:20:20.201 - DEBUG [org.opensaml.xml.signature.impl.PKIXSignatureTrustEngine:162] - PKIX validation of signature failed, unable to resolve valid and trusted signing key</div><div>18:20:20.201 - DEBUG [org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule:136] - Validation of protocol message signature failed for context issuer &#39;sp_dms&#39;, message type: {urn:oasis:names:tc:SAML:2.0:protocol}AuthnRequest</div><div>18:20:20.202 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:406] - Message did not meet security requirements</div><div>org.opensaml.ws.security.SecurityPolicyException: Validation of protocol message signature failed</div><div><span class="" style="white-space:pre">        </span>at org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule.doEvaluate(SAMLProtocolMessageXMLSignatureSecurityPolicyRule.java:138) ~[opensaml-2.6.2.jar:na]</div><div><span class="" style="white-space:pre">        </span>at org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule.evaluate(SAMLProtocolMessageXMLSignatureSecurityPolicyRule.java:107) ~[opensaml-2.6.2.jar:na]</div><div><span class="" style="white-space:pre">        </span>at org.opensaml.ws.security.provider.BasicSecurityPolicy.evaluate(BasicSecurityPolicy.java:51) ~[openws-1.5.2.jar:na]</div><div><span class="" style="white-space:pre">        </span>at org.opensaml.ws.message.decoder.BaseMessageDecoder.processSecurityPolicy(BaseMessageDecoder.java:132) ~[openws-1.5.2.jar:na]</div><div><span class="" style="white-space:pre">        </span>...</div><div>18:20:20.203 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:339] - LoginContext key cookie was not present in request</div><div>18:20:20.203 - DEBUG [edu.internet2.middleware.shibboleth.idp.ui.ServiceContactTag:177] - No relying party, nothing to display</div><div>18:20:20.236 - TRACE [edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:117] - Attempting to retrieve IdP session cookie.</div><div><br></div><div>I loaded Shib&#39;s idp.crt file into the SP (they stored it in the KeyStore) but as you can see I getting a problem with the certificate.</div><div><br></div><div>I&#39;ve found several other posts on the web about this problem (Failed to establish trust of KeyInfo-derived credential) but none of them worked for me.</div><div><br></div><div>Any help is appreciated.</div><div><br></div><div>Thanks!</div></div>