title: Issues while integrating ADFS with Spring SAML Extension
body: <p>I am working on integrating Spring SAML Extension within our appliaction and for SSO with one of our client's ADFS2.0 as the IDP we have generated Service provider meta data from our appliaction and imported ADFS meta data into our appliaction.When i select the clients idp and click on start single sign and give the proper clients credentials we are seeing the the SAML response as follows:</p>
  
  <p>Saml Response.</p>
  
  <pre><code>&lt;samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"  Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified"  
  Destination="https://sso.spire2grow.com:8443/&lt;our application&gt;/saml/SSO" ID="_d7fa7cb7-a858-4d4e-aa4c-bf7a5d11e485" 
  InResponseTo="a2icei36d347di68gi33534cc13fd1" IssueInstant="2014-09-30T14:17:21.819Z" Version="2.0"&gt;&lt;Issuer 
  xmlns="urn:oasis:names:tc:SAML:2.0:assertion"&gt;&lt;Clients ADFS trust services URL&gt;&lt;/Issuer&gt;&lt;samlp:Status&gt;&lt;samlp:StatusCode 
  Value="urn:oasis:names:tc:SAML:2.0:status:Responder"&gt;&lt;/samlp:StatusCode&gt;&lt;/samlp:Status&gt;&lt;/samlp:Response&gt;
  </code></pre>
  
  <p>but also i am seeing following exception being thrown as the service provider is not able to validate the message.</p>
  
  <p>Exception message:</p>
  
  <pre><code>[351545]2014-09-30 19:47:21,714 DEBUG - SAML message intended destination endpoint matched recipient endpoint
  [351545]2014-09-30 19:47:21,714 DEBUG - Authentication attempt using org.springframework.security.saml.SAMLAuthenticationProvider
  [351545]2014-09-30 19:47:21,715 DEBUG - Error validating SAML message
  org.opensaml.common.SAMLException: Response has invalid status code urn:oasis:names:tc:SAML:2.0:status:Responder, status message is null
      at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.processAuthenticationResponse(WebSSOProfileConsumerImpl.java:113)
      at org.springframework.security.saml.SAMLAuthenticationProvider.authenticate(SAMLAuthenticationProvider.java:82)
      at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:156)
      at org.springframework.security.saml.SAMLProcessingFilter.attemptAuthentication(SAMLProcessingFilter.java:84)
      at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:195)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
  </code></pre>
  
  <p>Could any one please point out if i mising any thing here.</p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>After seeing the answer provided for this question 
  I saw the following error from ADFS.</p>
  
  <pre><code>Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSignatureAlgorithmMismatchException: MSIS7093: The message is not signed with expected signature algorithm. Message is signed with signature algorithm http://www.w3.org/2000/09/xmldsig#rsa-sha1. Expected signature algorithm http://www.w3.org/2001/04/xmldsig-more#rsa-sha256. at Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolManager.ValidateSignatureRequirements(SamlMessage samlMessage) at Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolManager.Issue(HttpSamlRequestMessage httpSamlRequestMessage, SecurityTokenElement onBehalfOf, String sessionState, String relayState, String&amp; newSamlSession, String&amp; samlpAuthenticationProvider, Boolean isUrlTranslationNeeded, WrappedHttpListenerContext context, Boolean isKmsiRequested)
  </code></pre>
  
  <p>But after seeing this we did change the Signing algorithm on the relying trust party to rsa-sha256 but still its displaying the same message .</p>
  
  <p>Do we need a genuine certificate for rsa-sha256? Will the self-signed certificate properly work?</p>