title: SSO with signing and signature validation doesn't work
body: <p>I have succesfully configured <em>SSO</em> using <em>WSO2IS 4.6.0</em> and <em>spring saml</em> grails plugin, but when I enable signing and signature validation like this: <a href="https://i.stack.imgur.com/1Oopl.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/1Oopl.png" alt="enter image description here"></a>
  I see errors on WSO2 console</p>
  
  <pre><code>WARN {org.wso2.carbon.identity.sso.saml.util.SAMLSSOUtil} -  Signature Validation Failed for the SAML Assertion : Signature is invalid.
  DEBUG org.wso2.carbon.identity.sso.saml.util.SAMLSSOUtil} -  org.opensaml.xml.validation.ValidationException: Unable to evaluate key against signature
  WARN {org.wso2.carbon.identity.sso.saml.processors.SPInitSSOAuthnRequestProcessor} -  Signature validation for Authentication Request failed.
  </code></pre>
  
  <p>I exported default public key (<code>wso2carbon</code>) from WSO2 keystore (<code>wso2carbon.jks</code>), and inserted certificate into <code>X509Certificate</code> section in my SP and IdP metadata.<br>
  Here is my IdP metadata:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8" standalone="yes"?&gt;
  &lt;EntityDescriptor entityID="https://localhost:9443/samlsso" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"&gt;
  &lt;IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"&gt;
      &lt;KeyDescriptor use="signing"&gt;
          &lt;ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;ds:X509Data&gt;
                  &lt;ds:X509Certificate&gt;***
                  &lt;/ds:X509Certificate&gt;
              &lt;/ds:X509Data&gt;
          &lt;/ds:KeyInfo&gt;
      &lt;/KeyDescriptor&gt;
      &lt;SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
                           Location="https://localhost:9443/samlsso"
                           ResponseLocation="https://localhost:9443/samlsso"/&gt;
      &lt;SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                           Location="https://localhost:9443/samlsso"/&gt;
      &lt;SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
                           Location="https://localhost:9443/samlsso"/&gt;
  &lt;/IDPSSODescriptor&gt;
  &lt;/EntityDescriptor&gt;
  </code></pre>
  
  <p>And SP metadata:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;md:EntityDescriptor entityID="local" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"&gt;
  &lt;md:SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"&gt;
      &lt;md:Extensions&gt;
          &lt;idpdisco:DiscoveryResponse xmlns:idpdisco="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="http://localhost:8080/spring-security-saml/login/auth/alias/localhost?disco=true"/&gt;
      &lt;/md:Extensions&gt;
      &lt;md:KeyDescriptor use="signing"&gt;
          &lt;ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;ds:X509Data&gt;
                  &lt;ds:X509Certificate&gt;
                      ****
                  &lt;/ds:X509Certificate&gt;
              &lt;/ds:X509Data&gt;
          &lt;/ds:KeyInfo&gt;
      &lt;/md:KeyDescriptor&gt;
      &lt;md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://localhost:8080/***/saml/SingleLogout/alias/local"/&gt;
      &lt;md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="http://localhost:8080/***/saml/SingleLogout/alias/local"/&gt;
      &lt;md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="http://localhost:8080/***/saml/logout/SingleLogout/local"/&gt;
      &lt;md:NameIDFormat&gt;urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress&lt;/md:NameIDFormat&gt;
      &lt;md:NameIDFormat&gt;urn:oasis:names:tc:SAML:2.0:nameid-format:transient&lt;/md:NameIDFormat&gt;
      &lt;md:NameIDFormat&gt;urn:oasis:names:tc:SAML:2.0:nameid-format:persistent&lt;/md:NameIDFormat&gt;
      &lt;md:NameIDFormat&gt;urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified&lt;/md:NameIDFormat&gt;
      &lt;md:NameIDFormat&gt;urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName&lt;/md:NameIDFormat&gt;
      &lt;md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://localhost:8080/***/saml/SSO/alias/local" index="0" isDefault="true"/&gt;
      &lt;md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="http://localhost:8080/***/saml/SSO/alias/local" index="1" isDefault="false"/&gt;
  &lt;/md:SPSSODescriptor&gt;
  &lt;/md:EntityDescriptor&gt;
  </code></pre>
  
  <p>My concern is that I use wrong certificate in either SP or IdP metadata, or it should be signed somehow.  </p>
  
  <p>What certificate should I use for IdP and what for SP metadata, and can I check if they are valid?<br>
  How can I get it properly using public key exported from WSO2 keystore?<br>
  Thank you!</p>
  
  <p>UPDATE: It works on 5.1.0 even with incorrect certificates in metadata, looks like an issue. Here is 5.1.0 Configuration:
  <a href="https://i.stack.imgur.com/uNNkT.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/uNNkT.png" alt="enter image description here"></a></p>