title: Spring Security SAML - Failed to verify signature
body: <p>I'm using the Spring Security SAML 2.0 sample webapp on Tomcat 7 and have modified it to try to get it to authenticate against a Ping Identity service. The webapp is talking to the service and it's sending back an assertion, but it's failing when trying to verify the signature, as shown by the debug output below:</p>
  
  <pre><code>- Attempting to verify signature and establish trust using KeyInfo-derived credentials
  - Signature contained no KeyInfo element, could not resolve verification credentials
  - Failed to verify signature and/or establish trust using any KeyInfo-derived credentials
  - Attempting to verify signature using trusted credentials
  - Failed to verify signature using either KeyInfo-derived or directly trusted credentials
  - Validation of received assertion failed, assertion will be skipped
  org.opensaml.xml.validation.ValidationException: Signature is not trusted or invalid
  </code></pre>
  
  <p>I understand that it's not able to verify the signature, and I have been given a certificate by the Ping Identity admins to use, but I'm unsure of how to include it in the application. I've tried adding it to the JKS (keystore) that comes with the sample application using the JDK's keytool program, but it can't seem to find it in there. I've also tried adding it to the service provider's metadata xml file like this:</p>
  
  <pre><code>&lt;md:KeyDescriptor use="signing"&gt;
      &lt;ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;ds:X509Data&gt;
              &lt;ds:X509Certificate&gt;
                  [Certificate is here...]
              &lt;/ds:X509Certificate&gt;
          &lt;/ds:X509Data&gt;
      &lt;/ds:KeyInfo&gt;
  &lt;/md:KeyDescriptor&gt;
  </code></pre>
  
  <p>However it still returns the same error.</p>
  
  <p>Is there a specific place I should put the certificate in order to validate the signature? I'm relatively new to SAML and application security in general, so I apologise if I'm using the wrong terminology.</p>