Single Sign On SAML service failing to decrypt
<p>I'm implementing the service provider side of a Single Sign On solution. We are using PHP and the samlphp library provided by Onelogin. Everything is going pretty well. The user can attempt to access our service and is redirected to the IDP login. Once they login there they are redirected back to our site. </p>

<p>This is where the problem occurs. Once back at our site we get an error...</p>

<pre><code>&lt;Entry reference="REF_56dea40aa6419" TimeStamp="2016/03/08 12:06:02" Category="Exception" Type="Error"&gt;&lt;![CDATA[

Description         Failure decrypting Data
File  Library/SSO/OneLogin/extlib/xmlseclibs/xmlseclibs.php
Line                357
Class               Exception
Stack               

UI                  Business console
User                -
Code                0
When                2016/03/08 12:06:02
URL called          https://stage.icky-yuk.co.za/?acs
Referred by         https://signon.blarg.co.za/adfs/ls/?SAMLRequest=hVNdrxIxEH038T%2BQfWc%2FgYsNYBD8IEEggD74YsZ2gCbddu10vVx%2Fvd2l5KJR7MsmM3NOzzmdHRGUqmLT2p30Fr%2FXSO7li44%2F51JpYm13HNVWMwMkiWkokZjjbDf9uGR5nLLKGme4UdGfuPswIELrpNEBt5iPo%2FXq7XL9frH6iv2ByDjvwzDvYZr3Hl7lw%2F6gKHp9gCLvpUWRP4iC5wH7GS15pnHkiX0pEBLVuNDkQDvfSbNBNy266XCfpSwdsDT7EtBz71lqcC3DybmKWJKQPGqjY6NEWbsaVMxN%2FBMSEAdKFCUBugne30gtpD7ed%2FztMkTsw36%2F6W7Wu31gmV6jmBlNdYl2h%2FaH5Phpu7wR5OCIsbHyKDU9kcOSgqbXwCmaXKhGTfCstW4n%2F4eW6ECAg7g6VaPkFntDV7GV97KYb4yS%2FOnSaM47Y0tw%2F%2FacxVlbkaJ7aEcZliDVVAiLRNEz0VQp8zizCA7HkbM1Rp3kdwFhM1G0e%2Bpjcnh2nZkpK7CSmnfDM3B3TeE5idv5mfI7t8XD5O5acsabOV%2Fe%2BM%2BjsaJ5ZOT%2B8r0FTZWxLkT1V%2FKgO7kj3M9c%2B7f%2F3eQX&amp;RelayState=https%3A%2F%2Fstage.icky-yuk.co.za%2F
]]&gt;&lt;/Entry&gt;
</code></pre>

<p>The metadata we are using with the SAML toolkit follows. It is in array form but I've spit it out json encoded so it is easier to read.</p>

<pre><code>{
    "sp": {
        "entityId": "https:\/\/stage.icky-yuk.co.za\/metadata.php",
        "assertionConsumerService": {
            "url": "https:\/\/stage.icky-yuk.co.za\/?acs"
        },
        "singleLogoutService": {
            "url": "https:\/\/stage.icky-yuk.co.za\/?slo"
        },
        "NameIDFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
    },
    "idp": {
        "entityId": "http:\/\/signon.blarg.co.za\/adfs\/services\/trust",
        "singleSignOnService": {
            "url": "https:\/\/signon.blarg.co.za\/adfs\/ls\/",
            "binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
        },
        "singleLogoutService": {
            "url": "https:\/\/signon.blarg.co.za\/adfs\/ls\/",
            "binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
        },
        "x509cert": "MIIC6DCCAdCgAwIBAgIQWs7JU0DcbYBHCIni\/zAt\/jANBgkqhkiG9w0BAQsFADAwMS4wLAYDVQQDEyVBREZTIFNpZ25pbmcgLSBzaWdub24ub2xkbXV0dWFsLmNvLnphMB4XDTE1MDkyMzEzMTIzNloXDTE2MDkyMjEzMTIzNlowMDEuMCwGA1UEAxMlQURGUyBTaWduaW5nIC0gc2lnbm9uLm9sZG11dHVhbC5jby56YTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALlEeD4FX2CxAjacT+EJKbOFcAy604yvSPjy2NjKhjqGBeiJ4NLP4YKU28cEVa11IjqN18GE7bsk8wmA6yXEcAXgJs869fj1ZIXXil06DMSB4eUD0CaERpUSt7o6JR15kdmOEHq9tQp\/rAYoux3rSKBjmdZQlYeUTe13jfabrov3ftvWX6lTOUpZuJ2t61yCyxNNMN9pp0RlfYP8M03kq2boAoUxbYSxf\/Kpli0HrkRxtBaBiwy9TyVNjyY39ItHgAr\/gUA4vnAZj0kmSZwAc7gS6IXVbqo0A50yARzz\/6yrvMhkiFaJxFhwqck2hvoBWKwVBSSjozmDYw++gNUstj0CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEArSA6CrhdDvJXX120n0RJesumZAGHWBdb9NpE8p6hBq5gE0BcJm8lp\/PvgAyY+ZkZVpQEXv05q4po4FkkV2NcsyLHWzZ3S\/7OrleblqUIGm83a9o9mko6RuPrxdVpiwnatDAdV8gzebcr2OvedXGvkNJryblxkW7Gepoh8iPo9pFQ78NMoTGia+eLb+PtkuSV5yqtSSi9ggk8mdO+L9rZxrc9Uvkod+FLbtFg0DClsN5b3qvzd00UDmmbQfvSVGB40UGC5KqmJGSXrXSk6jUokm+h2VOUNSDyArMuiRtyFNrfY8GrWCc5Kz\/3ACuzEEhhTwD+67+qJH5jDD7KTDPQ\/w=="
    }
}
</code></pre>

<p>I've double-checked the x509 certification and it is good. I admit I'm not a SAML or Single Sign On expert by any stretch of the imagination. I'm obviously overlooking something here. Is there some other component to the encryption beyond the cert? I'm not sure where to look anymore.</p>