title: How to debug an Invalid Signature on SAML Response
body: <p>We're using <a href="https://github.com/onelogin/ruby-saml" rel="nofollow noreferrer">ruby-saml</a> to establish our app as a service provider while using Google as an identity provider, though I do not think this question is specific to Ruby or that project.</p>
  
  <p>I have seen <a href="https://stackoverflow.com/questions/28015152/saml-sp-complaining-invalid-digital-signature">this answer from the point of view of an IdP</a>, but I'm hoping to see one from the point of view of an SP, because I have a hard time believing Google is getting the signature on the response wrong.</p>
  
  <p>On top of that, we have successfully integrated with other Google accounts, and they work at the same time this one is broken.</p>
  
  <p>As the service providers, how can we figure out the source of an Invalid Signature on SAML Response from the identity provider?</p>