The IdP certificate is not a valid one as the SAML Auth Handler is trying to validate the SAML Response against the certificate added into the AEM trust store.
Please correct the certificate and you should not see this issue.
same can be seen the API as well
private boolean verifySignatures(Element parentElement, Element signedElement, Key publicKey)
{
if (publicKey != null)
{
NodeList signatureNodes = signedElement.getElementsByTagNameNS("http://www.w3.org/2000/09/xmldsig#", "Signature");
if (signatureNodes.getLength() == 0)
{
this.log.warn("Received SAML message without signature element.");
return false;
}
for (int j = 0; j < signatureNodes.getLength(); j++) {
try
{
DOMValidateContext valContext = new DOMValidateContext(publicKey, signatureNodes.item(j));
valContext.setIdAttributeNS(signedElement, null, "ID");
valContext.setIdAttributeNS(parentElement, null, "ID");
String providerName = System.getProperty("jsr105Provider", "org.apache.jcp.xml.dsig.internal.dom.XMLDSigRI");
XMLSignatureFactory sigFactory = XMLSignatureFactory.getInstance("DOM", (Provider)Class.forName(providerName).newInstance());
XMLSignature signature = sigFactory.unmarshalXMLSignature(valContext);
if (!signature.validate(valContext)) {
return false;
}
}
catch (MarshalException e)
{
this.log.error("Could not unmarshal XML signature.", e);
return false;
}
catch (XMLSignatureException e)
{
this.log.error("Failed validating signature.", e);
return false;
}
catch (ClassNotFoundException e)
{
this.log.error("Failed obtaining the signature provider: ", e);
return false;
}
catch (InstantiationException e)
{
this.log.error("Failed obtaining the signature provider: ", e);
return false;
}
catch (IllegalAccessException e)
{
this.log.error("Failed obtaining the signature provider: ", e);
return false;
}
}
}
else
{
this.log.warn("Could not verify signatures. Public key of IdP not provided.");
return false;
}
return true;
}
As you can see it is trying to validate against IdP certificate which is causing the error.
