title: Spring SAML signature validation issue
body: <p>I'm trying to use the Spring SAML sample app to connect to a Shibboleth IdP but have run into a signature validation issue that I haven't been able to resolve.  </p>
  
  <p>When the sample app gets the response from the IdP, an exception is thrown with the following:</p>
  
  <pre><code>Caused by: org.opensaml.ws.security.SecurityPolicyException: Validation of protocol message signature failed
  at org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule.doEvaluate(SAMLProtocolMessageXMLSignatureSecurityPolicyRule.java:138)
  at org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule.evaluate(SAMLProtocolMessageXMLSignatureSecurityPolicyRule.java:107)
  at org.opensaml.ws.security.provider.BasicSecurityPolicy.evaluate(BasicSecurityPolicy.java:51)
  at org.opensaml.ws.message.decoder.BaseMessageDecoder.processSecurityPolicy(BaseMessageDecoder.java:132)
  at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:83)
  at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70)
  at org.springframework.security.saml.processor.SAMLProcessorImpl.retrieveMessage(SAMLProcessorImpl.java:105)
  at org.springframework.security.saml.processor.SAMLProcessorImpl.retrieveMessage(SAMLProcessorImpl.java:172)
  at org.springframework.security.saml.SAMLProcessingFilter.attemptAuthentication(SAMLProcessingFilter.java:80)
  </code></pre>
  
  <p>With the log containing</p>
  
  <pre><code>- Creating XMLSignature object
  - Validating signature with signature algorithm URI: http://www.w3.org   /2001/04/xmldsig-more#rsa-sha256
  - Validation credential key algorithm 'RSA', key instance class 'sun.security.rsa.RSAPublicKeyImpl'
  - Signature validated with key from supplied credential
  - Signature validation using candidate credential was successful
  - Successfully verified signature using KeyInfo-derived credential
  - Attempting to establish trust of KeyInfo-derived credential
  - Failed to establish trust of KeyInfo-derived credential
  </code></pre>
  
  <p>so it looks like the signature is being validated but the key is not trusted.  What I can't figure out is how to "establish" the trust.</p>
  
  <p>I set up the sample app by</p>
  
  <ol>
  <li><p>Copying the IdP metadata to the sample app and loading it by adding this to securityContext.xml</p>
  
  <pre><code>&lt;bean id="metadata" class="org.springframework.security.saml.metadata.CachingMetadataManager"&gt;
  &lt;constructor-arg&gt;
      &lt;list&gt;
          &lt;!-- Example of classpath metadata with Extended Metadata --&gt;
          &lt;bean class="org.springframework.security.saml.metadata.ExtendedMetadataDelegate"&gt;
              &lt;constructor-arg&gt;
                  &lt;bean class="org.opensaml.saml2.metadata.provider.ResourceBackedMetadataProvider"&gt;
                      &lt;constructor-arg&gt;
                          &lt;bean class="java.util.Timer"/&gt;
                      &lt;/constructor-arg&gt;
                      &lt;constructor-arg&gt;
                          &lt;bean class="org.opensaml.util.resource.ClasspathResource"&gt;
                              &lt;constructor-arg value="/metadata/twoss-metadata.xml"/&gt;
                          &lt;/bean&gt;
                      &lt;/constructor-arg&gt;
                      &lt;property name="parserPool" ref="parserPool"/&gt;
                  &lt;/bean&gt;
              &lt;/constructor-arg&gt;
              &lt;constructor-arg&gt;
                  &lt;bean class="org.springframework.security.saml.metadata.ExtendedMetadata"&gt;
                              &lt;property name="signingKey" value="shib-signing"/&gt;
                              &lt;property name="trustedKeys" value="shib-signing"/&gt;
                  &lt;/bean&gt;
              &lt;/constructor-arg&gt;
                   &lt;property name="metadataTrustCheck" value="false"/&gt;
          &lt;/bean&gt;
      &lt;/list&gt;
  &lt;/constructor-arg&gt;
  </code></pre>
  
  <p></p></li>
  <li><p>Configuring the SP metadata like so</p>
  
  <pre><code>&lt;bean id="metadataGeneratorFilter" class="org.springframework.security.saml.metadata.MetadataGeneratorFilter"&gt;
  &lt;constructor-arg&gt;
      &lt;bean class="org.springframework.security.saml.metadata.MetadataGenerator"&gt;
              &lt;property name="entityId" value="urn:test:dan:vancouver"/&gt;
          &lt;property name="extendedMetadata"&gt;
              &lt;bean class="org.springframework.security.saml.metadata.ExtendedMetadata"&gt;
                        &lt;property name="signMetadata" value="false"/&gt;
                  &lt;property name="idpDiscoveryEnabled" value="true"/&gt;
              &lt;/bean&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  &lt;/constructor-arg&gt;
  </code></pre>
  
  <p></p></li>
  <li><p>And finally, I added the signing certificate generated during the Shibboleth installation to the sample app's keystore</p>
  
  <pre><code>keytool -importcert -alias shib-signing -file idp-signing.crt -keystore samlKeystore.jks
  </code></pre>
  
  <p>So, the question is, what do I need to do to get the trust established?</p></li>
  </ol>
  
  <p>Note that both the sample app and shibboleth are in a development environment and are not using CA-signed certificates for either signing or encryption purposes.</p>