title: Can't figure out why SAMLMessageSignature.Verify is returning false
body: <p>I have setup Shibboleth as an IdP, using its default credentials (the certificates bundled with the installer).  I think it is using the idp-signing.crt certificate to sign SAML responses.  Using the LowLevelAPI ShibbolethSP example project, I have been able to login through the Shibboleth IdP, as long as I comment out the "Verify the response's signature" code.  I made sure I added in SHA-256 XML signature support in Global.asax.cs, Application_Start.  The message signature verification always returns false, even when I copy the idp-signing.crt file into the example directory and load that as a X509Certificate2 object, passing that in:</p>
  
  <pre><code>bool retVal = SAMLMessageSignature.Verify(samlResponseXml, x509Certificate);  // is false
  </code></pre>
  
  <p>It <em>even</em> returns false when I pass no second param in, using the key info included with the signature to perform the verification:</p>
  
  <pre><code>bool retVal = SAMLMessageSignature.Verify(samlResponseXml);  // is false
  </code></pre>
  
  <p>I can't figure out why this verification is failing.  Here is a SAML response that is posted back from Shibboleth (formatted by FOXE but otherwise unchanged):</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;saml2p:Response Destination="http://localhost:65231/SAML/AssertionConsumerService.aspx" ID="_b69dae7dd40119cff94ece076e338e82" InResponseTo="_031b0667-d6e5-4845-add1-f82748afe0e6" IssueInstant="2015-02-06T14:07:47.193Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"&gt;
      &lt;saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"&gt;http://localhost:3380/idp/shibboleth&lt;/saml2:Issuer&gt;
      &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;ds:SignedInfo&gt;
              &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
              &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/&gt;
              &lt;ds:Reference URI="#_b69dae7dd40119cff94ece076e338e82"&gt;
                  &lt;ds:Transforms&gt;
                      &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/&gt;
                      &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                  &lt;/ds:Transforms&gt;
                  &lt;ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/&gt;
                  &lt;ds:DigestValue&gt;kL7hYIdYRk+x27VboYeYmIzOSfokmY8iPfucnFzI5Nk=&lt;/ds:DigestValue&gt;
              &lt;/ds:Reference&gt;
          &lt;/ds:SignedInfo&gt;
          &lt;ds:SignatureValue&gt;
  V/bRv+kjvXcTOQs3d2TjyB4d0fjW5xSl5/8RJzCf1K988DsUWVqZEswxo4iqPVsjQgkelppbcnPa
  9UTjLJLIQLg6ztXrfaXYE6iHZcYw58upBcnTXgNGuKazvLm6j2wxBtm5RNe8I4vO0YtDvV3GNf6X
  qVICZlhp7VC0bNiCMr7zVXcw0E4ZfCSJt3Tph9MGKK6KrSXzVSpsyagtvBnmDx2CpI+O0hW92ekk
  CjjkPcvY0lfl3rYdN/xpUqsJgc6HfhnBeU+y+RgEyb0eLuN/aZBOfiWMSAtMkJhcaoESwBtlaFg/
  m46jdarT6ZDGfU9J4JnOzkAHlr8nMlEKcEzD8g==
  &lt;/ds:SignatureValue&gt;
          &lt;ds:KeyInfo&gt;
              &lt;ds:X509Data&gt;
                  &lt;ds:X509Certificate&gt;MIIDIDCCAgigAwIBAgIVANgMuf9G9xkZYBghdEkxjLMPwHJhMA0GCSqGSIb3DQEBCwUAMBgxFjAU
  BgNVBAMMDWlzYW1zLXdyay0wNjAwHhcNMTUwMjA0MTU0MjQ1WhcNMzUwMjA0MTU0MjQ1WjAYMRYw
  FAYDVQQDDA1pc2Ftcy13cmstMDYwMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq3l+
  c0OfVj6Qex2Rwd+katoP9BLsrur/aR19mfepT5E2E/2TDWkl+dY87O4eS/J/NKTftS0MeL8qhoZB
  Hf3y/zetOayoqhW5eCsrWwsY4HuVBhBBctuv0xdBmQPUP8Avmdr83Ps0xvCu2661aAz5SRA1SOlP
  QbE/STLnDoFORhaoVAFHUq0zIscjCwUFrhHvEQZQWMTeaDCZdSP6jFmZ6SCWJCvjq7FIz5KbPh5p
  IBhaWUVIoGEg3gwGKEt25sZ6y7RSFnqEzWgJhUoHE8HgL4inGulTIeeESxztQqdRK7lkTz1VwwO/
  zulQdwcw1xWQc6JOMDh9wqJxcMQOZ2OlgQIDAQABo2EwXzAdBgNVHQ4EFgQUDAZa8uahYPYMrzbv
  P8+PRP47IzEwPgYDVR0RBDcwNYINaXNhbXMtd3JrLTA2MIYkaHR0cHM6Ly9pc2Ftcy13cmstMDYw
  L2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEBCwUAA4IBAQCLh6w9di9jggroTxCsX30eqVv+DSfG
  vOy1Ajj9ZFbXz5N7lhnwiLnWkiC4sx9Ls4cObj9AmGCAw/G2VOv2DRfRujFt0QTRfervmT1dJADv
  m2RsV4vq13Kbj5fh6ThCzTMU+XsRc6dY2KRiDMrR3ofdqIl90U4J4NeyFYvIwEKHSDrnLM2Fp6tu
  pWso0hDDSszuIKlhTue0kKXLpiJMEvc06mCqA8XZCCj26D6DdTNUI24puTfUELWXSMflD2/lg0/w
  L1k/5kVbgT4vqVci6Sz9ggi8mge2zjRtx4JkHIjXc20e43oRPh7LF/2wQVqiobmZQYzvMi5TPY1x
  w0oA4g5A&lt;/ds:X509Certificate&gt;
              &lt;/ds:X509Data&gt;
          &lt;/ds:KeyInfo&gt;
      &lt;/ds:Signature&gt;
      &lt;saml2p:Status&gt;
          &lt;saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/&gt;
      &lt;/saml2p:Status&gt;
      &lt;saml2:Assertion ID="_9d0be4db6f36fbd7026dc1efd7dfc224" IssueInstant="2015-02-06T14:07:47.193Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"&gt;
          &lt;saml2:Issuer&gt;http://localhost:3380/idp/shibboleth&lt;/saml2:Issuer&gt;
          &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;ds:SignedInfo&gt;
                  &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                  &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/&gt;
                  &lt;ds:Reference URI="#_9d0be4db6f36fbd7026dc1efd7dfc224"&gt;
                      &lt;ds:Transforms&gt;
                          &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/&gt;
                          &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                      &lt;/ds:Transforms&gt;
                      &lt;ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/&gt;
                      &lt;ds:DigestValue&gt;hR6KDOh+st3yunebqeUz4aqHMin/5rc6gHrkIwgypLc=&lt;/ds:DigestValue&gt;
                  &lt;/ds:Reference&gt;
              &lt;/ds:SignedInfo&gt;
              &lt;ds:SignatureValue&gt;
  V9BB0UEBqsBGsiUHbVH8mw8sG52pLI6ec/lGMCqeNGqTUYF8HwOPpjkViJ/Pz91HRFIgRoPlVqHy
  dRGMAJFpYvakOh/vB1+GP3T0Jh20gF8I7JfzOfMwuF8A5ryEdoxB6JQp0AR6mEXi88RPFfWrAmB1
  G/mTt6Q94uW0lrqfiyphp49K6HNhRvyIOCOLWtthBdnMQPLlCh6NAMaJAh+2dzx2CjeT4P58H9FP
  ANJQxB+JR3J2cum5XVn+Rrrx6fiL640I514G0dDu2bi4InXMGH/mKXVCLQX4w/1g0fGv/icrdY9H
  734JhawjfY/+NfO4Fj3+E6Yx3+k8ytku0qUZkw==
  &lt;/ds:SignatureValue&gt;
              &lt;ds:KeyInfo&gt;
                  &lt;ds:X509Data&gt;
                      &lt;ds:X509Certificate&gt;MIIDIDCCAgigAwIBAgIVANgMuf9G9xkZYBghdEkxjLMPwHJhMA0GCSqGSIb3DQEBCwUAMBgxFjAU
  BgNVBAMMDWlzYW1zLXdyay0wNjAwHhcNMTUwMjA0MTU0MjQ1WhcNMzUwMjA0MTU0MjQ1WjAYMRYw
  FAYDVQQDDA1pc2Ftcy13cmstMDYwMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq3l+
  c0OfVj6Qex2Rwd+katoP9BLsrur/aR19mfepT5E2E/2TDWkl+dY87O4eS/J/NKTftS0MeL8qhoZB
  Hf3y/zetOayoqhW5eCsrWwsY4HuVBhBBctuv0xdBmQPUP8Avmdr83Ps0xvCu2661aAz5SRA1SOlP
  QbE/STLnDoFORhaoVAFHUq0zIscjCwUFrhHvEQZQWMTeaDCZdSP6jFmZ6SCWJCvjq7FIz5KbPh5p
  IBhaWUVIoGEg3gwGKEt25sZ6y7RSFnqEzWgJhUoHE8HgL4inGulTIeeESxztQqdRK7lkTz1VwwO/
  zulQdwcw1xWQc6JOMDh9wqJxcMQOZ2OlgQIDAQABo2EwXzAdBgNVHQ4EFgQUDAZa8uahYPYMrzbv
  P8+PRP47IzEwPgYDVR0RBDcwNYINaXNhbXMtd3JrLTA2MIYkaHR0cHM6Ly9pc2Ftcy13cmstMDYw
  L2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEBCwUAA4IBAQCLh6w9di9jggroTxCsX30eqVv+DSfG
  vOy1Ajj9ZFbXz5N7lhnwiLnWkiC4sx9Ls4cObj9AmGCAw/G2VOv2DRfRujFt0QTRfervmT1dJADv
  m2RsV4vq13Kbj5fh6ThCzTMU+XsRc6dY2KRiDMrR3ofdqIl90U4J4NeyFYvIwEKHSDrnLM2Fp6tu
  pWso0hDDSszuIKlhTue0kKXLpiJMEvc06mCqA8XZCCj26D6DdTNUI24puTfUELWXSMflD2/lg0/w
  L1k/5kVbgT4vqVci6Sz9ggi8mge2zjRtx4JkHIjXc20e43oRPh7LF/2wQVqiobmZQYzvMi5TPY1x
  w0oA4g5A&lt;/ds:X509Certificate&gt;
                  &lt;/ds:X509Data&gt;
              &lt;/ds:KeyInfo&gt;
          &lt;/ds:Signature&gt;
          &lt;saml2:Subject&gt;
              &lt;saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="http://localhost:3380/idp/shibboleth" SPNameQualifier="http://localhost:65231/SAML/metadata.xml"&gt;AAdzZWNyZXQxpeMWTEyWX1tgYmk7ixdbi775mfBFBHikiub8dsf7HLwD2Xo5yPhD2HL21GF3Hle9oYEQCMFJ3R2dxZ8y22FknvLoGmDZ++VdymaQB0WpEaMzy3Ox9g8X6ALYMdZWedk78uCbpSvjpqdCM4Lhi13VdAQqvAs=&lt;/saml2:NameID&gt;
              &lt;saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"&gt;
                  &lt;saml2:SubjectConfirmationData Address="127.0.0.1" InResponseTo="_031b0667-d6e5-4845-add1-f82748afe0e6" NotOnOrAfter="2015-02-06T14:12:47.236Z" Recipient="http://localhost:65231/SAML/AssertionConsumerService.aspx"/&gt;
              &lt;/saml2:SubjectConfirmation&gt;
          &lt;/saml2:Subject&gt;
          &lt;saml2:Conditions NotBefore="2015-02-06T14:07:47.193Z" NotOnOrAfter="2015-02-06T14:12:47.193Z"&gt;
              &lt;saml2:AudienceRestriction&gt;
                  &lt;saml2:Audience&gt;http://localhost:65231/SAML/metadata.xml&lt;/saml2:Audience&gt;
              &lt;/saml2:AudienceRestriction&gt;
          &lt;/saml2:Conditions&gt;
          &lt;saml2:AuthnStatement AuthnInstant="2015-02-06T14:07:47.057Z" SessionIndex="_267b5fd351054d45e5961e83427483fe"&gt;
              &lt;saml2:SubjectLocality Address="127.0.0.1"/&gt;
              &lt;saml2:AuthnContext&gt;
                  &lt;saml2:AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:Password&lt;/saml2:AuthnContextClassRef&gt;
              &lt;/saml2:AuthnContext&gt;
          &lt;/saml2:AuthnStatement&gt;
          &lt;saml2:AttributeStatement&gt;
              &lt;saml2:Attribute FriendlyName="username" Name="urn:ecolint.ch:attribute-def:username" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"&gt;
                  &lt;saml2:AttributeValue&gt;Jeremy.Morton&lt;/saml2:AttributeValue&gt;
              &lt;/saml2:Attribute&gt;
          &lt;/saml2:AttributeStatement&gt;
      &lt;/saml2:Assertion&gt;
  &lt;/saml2p:Response&gt;
  </code></pre>
  
  <p>Can anyone tell me why the Verify method might always be returning false?</p>