<div dir="ltr"><p class="MsoNormal" style="margin:0in 0in 8pt;line-height:115%;font-size:12pt;font-family:Aptos,sans-serif"><span style="font-size:12pt">Hi.</span></p><p class="MsoNormal" style="margin:0in 0in 8pt;line-height:115%;font-size:12pt;font-family:Aptos,sans-serif"><span style="font-size:12pt">I </span>have problem<span style="font-size:12pt"> </span>to download<span style="font-size:12pt"> metadata from Keycloak to Shibboleth SP.</span></p>

<p class="MsoNormal" style="margin:0in 0in 8pt;line-height:115%;font-size:12pt;font-family:Aptos,sans-serif">The problem I see is that <span style="font-size:10pt;line-height:115%;font-family:"Segoe UI",sans-serif;color:rgb(10,10,10);background:rgb(253,253,252)">Keycloak's Java XML signature library uses </span><code style="box-sizing:border-box;outline-color:rgb(41,119,214);font-variant-ligatures:none;font-feature-settings:normal;border-radius:4px;background:padding-box border-box rgba(10,10,10,0.04);font-family:"Courier New""><span style="font-size:9pt;line-height:115%;color:rgb(10,10,10);border:1pt solid rgb(31,31,30);padding:0in">dsig:</span></code><span style="font-size:10pt;line-height:115%;font-family:"Segoe UI",sans-serif;color:rgb(10,10,10);background:rgb(253,253,252)"> as the namespace prefix (</span><code style="box-sizing:border-box;outline-color:rgb(41,119,214);font-variant-ligatures:none;font-feature-settings:normal;border-radius:4px;background:padding-box border-box rgba(10,10,10,0.04);font-family:"Courier New""><span style="font-size:9pt;line-height:115%;color:rgb(10,10,10);border:1pt solid rgb(31,31,30);padding:0in"><dsig:Signature
xmlns:dsig="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"></span></code><span style="font-size:10pt;line-height:115%;font-family:"Segoe UI",sans-serif;color:rgb(10,10,10);background:rgb(253,253,252)">), All other IdPs I have worked with use <code style="font-family:"Courier New""><span style="font-size:9pt;line-height:115%;border:1pt solid rgb(31,31,30);padding:0in">ds:</span></code><span style="font-size:10pt;line-height:115%;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial"> as the namespace prefix.</span></span></p>

<p class="MsoNormal" style="margin:0in 0in 8pt;line-height:115%;font-size:12pt;font-family:Aptos,sans-serif"><span style="font-size:10pt;line-height:115%;font-family:"Segoe UI",sans-serif;color:rgb(10,10,10);background:rgb(253,253,252)">I don’t think Keycloak
is doing anything wrong here, both </span><code style="font-family:"Courier New""><span style="font-size:9pt;line-height:115%;color:rgb(10,10,10);border:1pt solid rgb(31,31,30);padding:0in">ds:</span></code><span style="font-size:10pt;line-height:115%;font-family:"Segoe UI",sans-serif;color:rgb(10,10,10);background:rgb(253,253,252)"> and <code style="font-family:"Courier New""><span style="font-size:9pt;line-height:115%;border:1pt solid rgb(31,31,30);padding:0in">dsig:</span></code><span style="font-size:10pt;line-height:115%;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial"> should work if I’m not mistaken. But Shibboleth
SP 3.5.2 fails to validate Keycloak's metadata signature with: "CredentialResolver
did not supply any candidate keys"<span style="font-size:10pt;line-height:115%;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial"></span></span></span></p><p class="MsoNormal" style="margin:0in 0in 8pt;line-height:115%;font-size:12pt;font-family:Aptos,sans-serif"><br></p><p class="MsoNormal" style="margin:0in 0in 8pt;line-height:115%;font-size:12pt;font-family:Aptos,sans-serif"><span style="font-size:10pt;line-height:115%;font-family:"Segoe UI",sans-serif;color:rgb(10,10,10);background:rgb(253,253,252)"><span style="font-size:10pt;line-height:115%;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial">/ Joakim</span></span></p></div>