title: Spring Security SAML IdP Metadata Certificate and Signature
body: <p>I have looked at many questions including <a href="https://stackoverflow.com/a/25384924/1317559">https://stackoverflow.com/a/25384924/1317559</a>. I have the IdP metadata and certificate, but can't seem to get Spring so see it. </p>
  
  <ul>
  <li>Added the certificate to the keystore: keytool -importcert -alias adfssigning -keystore samlKeystore.jks -file certificate.crt</li>
  <li>In the metadata there are multiple certificates (2 different ones) and a SignatureValue. </li>
  <li>I tried to add the signature value with the same keytool command, but it is not a certificate.</li>
  <li>I tried to add the 2 certificates found in the metadata also.</li>
  </ul>
  
  <p>I enabled debugging log and this is what I get:</p>
  
  <ul>
  <li>Successfully verified signature using KeyInfo-derived credential</li>
  <li>Attempting to establish trust of KeyInfo-derived credential</li>
  <li>Supplied trusted names are null or empty, skipping name evaluation</li>
  <li>Attempting PKIX path validation on untrusted credential: [subjectName='O=novell,OU=accessManager,CN=test-signing']</li>
  <li>PKIX path construction failed for untrusted credential: [subjectName='O=novell,OU=accessManager,CN=test-signing']: unable to find valid certification path to requested target</li>
  <li>Signature trust could not be established via PKIX validation of signing credential</li>
  <li>Failed to establish trust of KeyInfo-derived credential</li>
  <li>Failed to verify signature and/or establish trust using any KeyInfo-derived credentials</li>
  <li>PKIX validation of signature failed, unable to resolve valid and trusted signing key</li>
  <li>Signature trust establishment failed for metadata entry <a href="http://idp.ppd.com/nidp/saml2/metadata" rel="nofollow noreferrer">http://idp.ppd.com/nidp/saml2/metadata</a></li>
  <li>Error filtering metadata from <a href="http://idp.ppd.com/nidp/saml2/metadata" rel="nofollow noreferrer">http://idp.ppd.com/nidp/saml2/metadata</a>
  org.opensaml.saml2.metadata.provider.FilterException: Signature trust establishment failed for metadata entry
  at org.opensaml.saml2.metadata.provider.SignatureValidationFilter.verifySignature(SignatureValidationFilter.java:312)</li>
  </ul>