<html><body><div dir="ltr">
If I understand your description correctly, it kinda doubles down on the diagnosis that the signing cert in the SP’s metadata is not the cert with which they signed the request (hence preventing the use of that cert to validate the signed request). You substituted a cert of your own in the metadata to produce “Same result”: that substituted cert certainly wasn’t used by the SP to sign the request, and that condition triggers exactly the error you document.</div><div dir="ltr"><br></div><div dir="ltr">Apologies if I misread your description.</div><div dir="ltr"><br></div><div dir="ltr">David</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On 12Oct2022 at 13:57:13, Steve Herrera via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" type="cite">
<div dir="ltr">This is the first SP that we have come across error messages like this. <div><br><div>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">2022-10-12 16:42:06,582 - WARN [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:275] - Message Handler:<span class="gmail-Apple-converted-space"> </span>Simple signature validation (with no request-derived credentials) failed</span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><br></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">
</span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">2022-10-12 16:42:06,583 - WARN [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:214] - Message Handler:<span class="gmail-Apple-converted-space"> </span>Validation of request simple signature failed for context issuer:</span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><br></span></p><p class="gmail-p1" style="margin:0px;font:11px Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">2022-10-12 16:42:06,583 - WARN [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Exception handling message</span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">
</span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">org.opensaml.messaging.handler.MessageHandlerException: Validation of request simple signature failed for context issuer</span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><br></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span style="color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-variant-ligatures:normal">I have searched the forum and one explanation was the certificate the SP provided was incorrect from the metadata received. I reviewed that and it is the same. I have the ability to configure the certificate that this SP provides in their metadata and generated a new certificate. Same result. I worked with their SAML techs and they made some minor changes on their end. They said they are using OpenSAML 3.3.1 </span></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span style="color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-variant-ligatures:normal"><br></span></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span style="color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-variant-ligatures:normal">This is the error when going to the URL for the SP:</span></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span style="color:rgb(113,113,113);font-family:Verdana,Geneva,sans-serif;font-size:12px;font-variant-ligatures:normal">The request cannot be fulfilled because the message received does not meet the security requirements of the login service.</span><span style="color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-variant-ligatures:normal"> </span><br></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span style="color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-variant-ligatures:normal"><br></span></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal;color:rgb(0,0,0)"><font face="arial, sans-serif">The logon page is never displayed. </font></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><br></span></p><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><br></div></div></div></div></div></div>
<div>
<div>
-- <br>For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div>
</div>
</blockquote>
</div></body></html>