<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Georgia;
panose-1:2 4 5 2 5 4 5 2 3 3;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
pre
{mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:Consolas;}
p.CodeStyle, li.CodeStyle, div.CodeStyle
{mso-style-name:CodeStyle;
mso-style-link:"CodeStyle Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Georgia",serif;}
span.CodeStyleChar
{mso-style-name:"CodeStyle Char";
mso-style-link:CodeStyle;
font-family:"Georgia",serif;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoPlainText">I’m trying to help get an SP to use our IdP and I’m running into an AuthnRequest signing issue. I’m hoping someone can help me discern the cause.<o:p></o:p></p>
<p class="MsoPlainText">We have metadata for this SP in the form of an X509 certificate:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><KeyDescriptor use="signing"><o:p></o:p></p>
<p class="MsoPlainText"> <dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><o:p></o:p></p>
<p class="MsoPlainText"> <dsig:KeyName>MXwrOk8KdR_98uoy06Nyq0b3hcKmCkB_3sZn1Led3LQ</dsig:KeyName><o:p></o:p></p>
<p class="MsoPlainText"> <dsig:X509Data><o:p></o:p></p>
<p class="MsoPlainText"> <dsig:X509Certificate>MIIHPzCCBiegAwIBAgIQDtIiDVWpZ1JcJgA/Ne26uDANBgkqhkiG9w0BAQsFADCB<o:p></o:p></p>
<p class="MsoPlainText">lTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G<o:p></o:p></p>
<p class="MsoPlainText">A1UEBxMHU2FsZm9yZDEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMT0wOwYDVQQD<o:p></o:p></p>
<p class="MsoPlainText">EzRTZWN0aWdvIFJTQSBPcmdhbml6YXRpb24gVmFsaWRhdGlvbiBTZWN1cmUgU2Vy<o:p></o:p></p>
<p class="MsoPlainText">dmVyIENBMB4XDTIyMDIwMTAwMDAwMFoXDTIzMDIwMTIzNTk1OVowgagxCzAJBgNV<o:p></o:p></p>
<p class="MsoPlainText">BAYTAlVTMRcwFQYDVQQIEw5Ob3J0aCBDYXJvbGluYTEQMA4GA1UEBxMHUmFsZWln<o:p></o:p></p>
<p class="MsoPlainText">aDEpMCcGA1UEChMgTGVhcm5pbmcgVGVjaG5vbG9naWVzIEdyb3VwIEluYy4xIzAh<o:p></o:p></p>
<p class="MsoPlainText">BgNVBAsTGkN1c3RvbWVyIFNpdGUgQ2VydGlmaWNhdGVzMR4wHAYDVQQDExVzYW1s<o:p></o:p></p>
<p class="MsoPlainText">LnBlb3BsZWZsdWVudC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB<o:p></o:p></p>
<p class="MsoPlainText">AQC4q1TlyZh91E453OQrITKzPqGkFCgRMDiSE4JVf4lzkQygx94uCZjV0cITljgY<o:p></o:p></p>
<p class="MsoPlainText">FF5Zo/zML/72ujuC3aAuIS+wDAr2OruOJ28UBpfERgj0fNy1MpDgQyqr5ZMsFCWh<o:p></o:p></p>
<p class="MsoPlainText">AhT3AXb7M4sqW6k86N6TdT6e+YyOo9QuuvATmXzOl3aSFih/ENmLAyBFho25mASC<o:p></o:p></p>
<p class="MsoPlainText">Svg3+44JR/hkvEwZUnDK0Yq0zKPiEpIROVp7H+4qfTfmkdYmJoTVSx1bGuIhtXbp<o:p></o:p></p>
<p class="MsoPlainText">R4yilS31ydPdWmaYa6Y7kQxD/JQZjdujYYZ34bpbtKqPSCaFN9hMU5QtGKHR8TsG<o:p></o:p></p>
<p class="MsoPlainText">8ktL/8pJz5SOYw4eCtgKN5m3AgMBAAGjggN0MIIDcDAfBgNVHSMEGDAWgBQX2dYl<o:p></o:p></p>
<p class="MsoPlainText">J2f5McJJQ9kwNkSMbKlP6zAdBgNVHQ4EFgQUEIIU/8DGhBROLRzKLKsSz7pVGT0w<o:p></o:p></p>
<p class="MsoPlainText">DgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUH<o:p></o:p></p>
<p class="MsoPlainText">AwEGCCsGAQUFBwMCMEoGA1UdIARDMEEwNQYMKwYBBAGyMQECAQMEMCUwIwYIKwYB<o:p></o:p></p>
<p class="MsoPlainText">BQUHAgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMAgGBmeBDAECAjBaBgNVHR8E<o:p></o:p></p>
<p class="MsoPlainText">UzBRME+gTaBLhklodHRwOi8vY3JsLnNlY3RpZ28uY29tL1NlY3RpZ29SU0FPcmdh<o:p></o:p></p>
<p class="MsoPlainText">bml6YXRpb25WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EuY3JsMIGKBggrBgEFBQcB<o:p></o:p></p>
<p class="MsoPlainText">AQR+MHwwVQYIKwYBBQUHMAKGSWh0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGln<o:p></o:p></p>
<p class="MsoPlainText">b1JTQU9yZ2FuaXphdGlvblZhbGlkYXRpb25TZWN1cmVTZXJ2ZXJDQS5jcnQwIwYI<o:p></o:p></p>
<p class="MsoPlainText">KwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMDsGA1UdEQQ0MDKCFXNh<o:p></o:p></p>
<p class="MsoPlainText">bWwucGVvcGxlZmx1ZW50LmNvbYIZd3d3LnNhbWwucGVvcGxlZmx1ZW50LmNvbTCC<o:p></o:p></p>
<p class="MsoPlainText">AX0GCisGAQQB1nkCBAIEggFtBIIBaQFnAHUArfe++nz/EMiLnT2cHj4YarRnKV3P<o:p></o:p></p>
<p class="MsoPlainText">sQwkyoWGNOvcgooAAAF+tjJtGwAABAMARjBEAiApFHTInF/rMI7MXc6mnrDrBijx<o:p></o:p></p>
<p class="MsoPlainText">ojRJ6CQ6i95pNCtAsgIgNiUrg5TI4SYiMknj7sZsKULUieLr1N8P1SP+JSDvSOwA<o:p></o:p></p>
<p class="MsoPlainText">dQB6MoxU2LcttiDqOOBSHumEFnAyE4VNO9IrwTpXo1LrUgAAAX62MmzhAAAEAwBG<o:p></o:p></p>
<p class="MsoPlainText">MEQCIEK3qKiEYSIauu0GqtBI9xn6t10++i1L28kqU/K2EmNTAiBC7wIdHFJQSrp6<o:p></o:p></p>
<p class="MsoPlainText">6rkayGTnNxgbMdaIY3c5uBlaq7KwWQB3AOg+0No+9QY1MudXKLyJa8kD08vREWvs<o:p></o:p></p>
<p class="MsoPlainText">62nhd31tBr1uAAABfrYybL8AAAQDAEgwRgIhAN7oyewM2+VmdXNwKjCnMsrK5VUE<o:p></o:p></p>
<p class="MsoPlainText">o3IjE18rtvTGPzAWAiEAgC6iyyLjDaxkorXtHRigwGB2pwlWo/YoMFGDM6UiZlEw<o:p></o:p></p>
<p class="MsoPlainText">DQYJKoZIhvcNAQELBQADggEBAJZl1eQr/YU/5FngOTurXz+vClhHZP2v/NbUe5Qy<o:p></o:p></p>
<p class="MsoPlainText">CW6zIbFY5ixfZNLVzyGc1RUmqS+J7KsbEgc7xu6O5WEn1d81ZR9iUCX7rBqol3eQ<o:p></o:p></p>
<p class="MsoPlainText">NEQsIm2c1Hm/3BDeHKouBOcofsmL1WNlnZKo7FT1DOM+JOuO541u/+zbRu/J9McK<o:p></o:p></p>
<p class="MsoPlainText">cAr2c6RA35BQW9OfqoGPuVmdPVuJSQ7BlLkxCwILyePoyGd1qUwgmd5p1z9D7A6Z<o:p></o:p></p>
<p class="MsoPlainText">TlV3JJrSNl0L6SKNhn5Q6GheQFqaqRGUGVqZieebzvv2wGyNEC02jhLQLV03QgOA<o:p></o:p></p>
<p class="MsoPlainText">Xysh19X5dGzJLrikIqNK9qsvKkjQkDSgjiw1uea8GFX79Kg=</dsig:X509Certificate><o:p></o:p></p>
<p class="MsoPlainText"> </dsig:X509Data><o:p></o:p></p>
<p class="MsoPlainText"> </dsig:KeyInfo><o:p></o:p></p>
<p class="MsoPlainText"> </KeyDescriptor><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The AuthnRequest from this SP is coming in with an RSAKeyValue in the signature and not an X509Data (which is different from most other SPs we have worked with):<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><?xml version="1.0" encoding="UTF-8"?><o:p></o:p></p>
<p class="MsoPlainText"><dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><o:p></o:p></p>
<p class="MsoPlainText"> <dsig:SignedInfo><o:p></o:p></p>
<p class="MsoPlainText"> <dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><o:p></o:p></p>
<p class="MsoPlainText"> <dsig:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" /><o:p></o:p></p>
<p class="MsoPlainText"> <dsig:Reference URI="#ID_f9a395be-eb95-443d-a79b-ca7c67dfdab8"><o:p></o:p></p>
<p class="MsoPlainText"> <dsig:Transforms><o:p></o:p></p>
<p class="MsoPlainText"> <dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><o:p></o:p></p>
<p class="MsoPlainText"> <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><o:p></o:p></p>
<p class="MsoPlainText"> </dsig:Transforms><o:p></o:p></p>
<p class="MsoPlainText"> <dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /><o:p></o:p></p>
<p class="MsoPlainText"> <dsig:DigestValue>Qje+BL96Zosg1wEcG/ZMbdUwYVbdaSYcNKKzNXIwDA8=</dsig:DigestValue><o:p></o:p></p>
<p class="MsoPlainText"> </dsig:Reference><o:p></o:p></p>
<p class="MsoPlainText"> </dsig:SignedInfo> <dsig:SignatureValue>XThpJP4jLfyDHqW+sQAP29T5UBgD/MoErjGx9AoMLLurKJIYpd9LM8qIEesTmMCjvKO5Sz7ACLFlQF/60Rtvv4Mid3HUVXWVRPJsW0HODcKdCqXErM6uiv5X/9vT50hwr5NhBIufbUfQe0VfW23RFQLykWl+/Fh5d6o1rc7jvdEYt9lI/z2iqCZXgI6FVqo7zelQUcELfbnwx4FuQNqRz8SJync4jPO0S9bUhtRSMvYleKS8ruWyaI/o19m9LLqrvC53Z66lWhfd/YFWzXDSO8yv0t4sqYGu8CGE1Ei2SOJdaT+BxzwnyopHhPpS/ZCHsKtmqTZJWCHj3HIM97em7A==</dsig:SignatureValue><o:p></o:p></p>
<p class="MsoPlainText"> <dsig:KeyInfo><o:p></o:p></p>
<p class="MsoPlainText"> <dsig:KeyValue><o:p></o:p></p>
<p class="MsoPlainText"> <dsig:RSAKeyValue><o:p></o:p></p>
<p class="MsoPlainText"><dsig:Modulus>pFfobLWE42ZaFD4VzOX9vvQsonD+Irji/j2CrmqePxfAI0W2k7EjTTR9UtkhPPBeH6Bg+AKflZ9dV1lmF4NZDkhYbNIZnbAy9KcRPPps6qbqJxn7cxfrUEbIJj/FfUwNupYNdLHWa33rPi+YhmXi8qv2QyYXteGhXsX1mpzJdDlQ1Bt1gd2z5WMptkeY56iHNPwRu09R6OaeoJDA0NxP8E7e6o2bu/gASll7rleMLchmFYl8UV+y5DVMq6QAujGVpdrgpQ9Vl4SCLQaC9GDeKrB9G3kDQxjS0eY5JYk6o4XnMoCM3AGwSCee61oCfELz8KQK0/pNrfoEJZ/XIvzzzQ==</dsig:Modulus><o:p></o:p></p>
<p class="MsoPlainText"> <dsig:Exponent>AQAB</dsig:Exponent><o:p></o:p></p>
<p class="MsoPlainText"> </dsig:RSAKeyValue><o:p></o:p></p>
<p class="MsoPlainText"> </dsig:KeyValue><o:p></o:p></p>
<p class="MsoPlainText"> </dsig:KeyInfo><o:p></o:p></p>
<p class="MsoPlainText"></dsig:Signature><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">For some reason, IdP (v3.4.7) is failing this request….it states the signature is valid but fails to establish the trust for this key. I do not know why…can anyone help?<o:p></o:p></p>
<p class="MsoPlainText">Here is a snippet from the log:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,018 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.signature.support.impl.BaseSignatureTrustEngine:189] - Attempting to verify signature and establish trust using KeyInfo-derived credentials<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,018 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver:356] - Found 0 key names: []<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,019 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver:319] - Processing KeyInfo child {http://www.w3.org/2000/09/xmldsig#}KeyValue with provider org.opensaml.xmlsec.keyinfo.impl.provider.RSAKeyValueProvider<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,019 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.keyinfo.impl.provider.RSAKeyValueProvider:76] - Attempting to extract credential from an RSAKeyValue<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,019 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.keyinfo.impl.provider.RSAKeyValueProvider:93] - Credential successfully extracted from RSAKeyValue<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,019 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver:329] - Credentials successfully extracted from child {http://www.w3.org/2000/09/xmldsig#}KeyValue by provider org.opensaml.xmlsec.keyinfo.impl.provider.RSAKeyValueProvider<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,019 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver:397] - Found a credential based on a KeyValue/DEREncodedKeyValue having key type: RSA<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,019 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver:213] - No credentials were extracted by registered non-KeyValue handling providers, adding KeyValue credential to returned
credential set<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,019 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver:179] - A total of 1 credentials were resolved<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,020 - 129.57.40.34 - DEBUG [org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry:96] - Registry could not locate evaluable criteria for criteria class org.opensaml.xmlsec.keyinfo.KeyInfoCriterion<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,020 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.signature.support.SignatureValidationProvider:53] - Using a validation provider of implementation: org.opensaml.xmlsec.signature.support.impl.provider.ApacheSantuarioSignatureValidationProviderImpl<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,020 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.signature.support.impl.provider.ApacheSantuarioSignatureValidationProviderImpl:50] - Attempting to validate signature using key from supplied credential<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,020 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.signature.support.impl.provider.ApacheSantuarioSignatureValidationProviderImpl:92] - Accessing XMLSignature object<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,020 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.signature.support.impl.provider.ApacheSantuarioSignatureValidationProviderImpl:65] - Validating signature with signature algorithm URI: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,020 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.signature.support.impl.provider.ApacheSantuarioSignatureValidationProviderImpl:66] - Validation credential key algorithm 'RSA', key instance class 'sun.security.rsa.RSAPublicKeyImpl'<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,021 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.signature.support.impl.provider.ApacheSantuarioSignatureValidationProviderImpl:71] - Signature validated with key from supplied credential<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,021 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.signature.support.impl.BaseSignatureTrustEngine:248] - Signature validation using candidate credential was successful<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,021 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.signature.support.impl.BaseSignatureTrustEngine:199] - Successfully verified signature using KeyInfo-derived credential<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,021 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.signature.support.impl.BaseSignatureTrustEngine:200] - Attempting to establish trust of KeyInfo-derived credential<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,021 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.signature.support.impl.PKIXSignatureTrustEngine:213] - Can not evaluate trust of non-X509Credential<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,021 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.signature.support.impl.BaseSignatureTrustEngine:205] - Failed to establish trust of KeyInfo-derived credential<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,021 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.signature.support.impl.BaseSignatureTrustEngine:216] - Failed to verify signature and/or establish trust using any KeyInfo-derived credentials<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,022 - 129.57.40.34 - DEBUG [org.opensaml.xmlsec.signature.support.impl.PKIXSignatureTrustEngine:166] - PKIX validation of signature failed, unable to resolve valid and trusted signing key<o:p></o:p></p>
<p class="MsoNormal">2022-04-06 10:00:23,022 - 129.57.40.34 - WARN [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:202] - Profile Action WebFlowMessageHandlerAdaptor: Exception handling message<o:p></o:p></p>
<p class="MsoNormal">org.opensaml.messaging.handler.MessageHandlerException: Validation of protocol message signature failed<o:p></o:p></p>
<p class="MsoNormal"> at org.opensaml.saml.common.binding.security.impl.SAMLProtocolMessageXMLSignatureSecurityHandler.doEvaluate(SAMLProtocolMessageXMLSignatureSecurityHandler.java:147)<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
</div>
</body>
</html>