Facing issue while importing SAML SSO IDP metadata in SP (service provider)
<p>I am using Spring SAML extension to connect with ping federate IDP server. I exported the ping federate IDP metadata xml and put it our application (and referring same file in securityContext.xml file). Now when I am trying to start my application then spring saml throwing following exception:</p>

<pre><code>Caused by: org.opensaml.saml2.metadata.provider.MetadataProviderException: Error filtering metadata from C:\Drive E\workspace\enigma_master\etc\saml\idp.xml
at org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.processNonExpiredMetadata(AbstractReloadingMetadataProvider.java:399)
at org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.processNewMetadata(AbstractReloadingMetadataProvider.java:355)
at org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.refresh(AbstractReloadingMetadataProvider.java:261)
... 100 more
Caused by: org.opensaml.saml2.metadata.provider.FilterException: Signature trust establishment failed for metadata entry
at org.opensaml.saml2.metadata.provider.SignatureValidationFilter.verifySignature(SignatureValidationFilter.java:327)
at org.opensaml.saml2.metadata.provider.SignatureValidationFilter.processEntityDescriptor(SignatureValidationFilter.java:178)
at org.opensaml.saml2.metadata.provider.SignatureValidationFilter.doFilter(SignatureValidationFilter.java:156)
at org.opensaml.saml2.metadata.provider.AbstractMetadataProvider.filterMetadata(AbstractMetadataProvider.java:493)
at org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.processNonExpiredMetadata(AbstractReloadingMetadataProvider.java:395)
... 102 more
</code></pre>

<p>I imported the certificate (one that is under tag <code>&lt;ds:X509Certificate&gt;</code>) in my samlkeystore file but still the same issue. I googled the error and as suggested:</p>

<ul>
<li>I tried to remove <code>&lt;ds:Signature&gt;</code> tag from idp xml file.</li>
<li>Disabling signature verification by setting property metadataTrustCheck to false in the ExtendedMetadataDelegate bean</li>
</ul>

<p>above approaches working for me. But I don't want to modify/remove tag from IDP xml file, it should work as it is. Please let me know what wrong I am doing?
Also I want to know what is the use of <code>&lt;ds:Signature&gt;</code> tag in metadata xml and why its not working even after importing certificate in samlKeystore file. And what is the meaning of each child tags like <code>&lt;ds:SignedInfo&gt;</code>,<code>&lt;ds:CanonicalizationMethod&gt;</code>, <code>&lt;ds:SignatureMethod&gt;</code>, <code>&lt;ds:Reference&gt;</code>, <code>&lt;ds:Transform&gt;</code>, <code>&lt;ds:DigestMethod&gt;</code>, <code>&lt;ds:DigestValue&gt;</code>, <code>&lt;ds:SignatureValue&gt;</code>. </p>

<p>Sample IDP metadata xml file </p>

<pre><code>&lt;md:EntityDescriptor ID="jsR9U9qdN-Tjy-hyM5k.nrQmQxF" cacheDuration="PT1440M" entityID="adeptia" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"&gt;&lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
&lt;ds:SignedInfo&gt;&lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
&lt;ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/&gt;
&lt;ds:Reference URI="#jsR9U9qdN-Tjy-hyM5k.nrQmQxF"&gt;
&lt;ds:Transforms&gt;&lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/&gt;
&lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;&lt;/ds:Transforms&gt;
&lt;ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/&gt;
&lt;ds:DigestValue&gt;slepuncWspzM7KpqKkvsk0SVL8k5yse7FmATDYZhgqE=&lt;/ds:DigestValue&gt;
&lt;/ds:Reference&gt;&lt;/ds:SignedInfo&gt;
&lt;ds:SignatureValue&gt;oSkTcfU4DUYPXwtgnN8bjAOnkqgFCojef087d0F4ra1nsrWBOQVC1xesSambwAdOiCtnnhxQqp4b2LeUSazdb0bI5A0U65Wc2MeoyfC/5nAfiso3DCNBaz4vRrlkvzm7MlHyvDzTO0T/+lSVhfIVWbEZ58iXjUdyPgbCBSlY6+GLOW3UfdYV73ewNEyWuaAjJrC4qNgTrTZwBiVD2WNM4qWgRkBxzJz+cgZLbvu/5XRfnNgeYT6OEAR2322okH01GtuuPYB7jgwM2TXJhH6eVR6FapCtJ5aUwUywCdg3YyvzzEqHWW8fDnTLNEbZbokpqbtTwvncMaOb1hhVfZr1pQ==&lt;/ds:SignatureValue&gt;
&lt;/ds:Signature&gt;&lt;md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" WantAuthnRequestsSigned="true"&gt;&lt;md:KeyDescriptor use="signing"&gt;&lt;ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;&lt;ds:X509Data&gt;&lt;ds:X509Certificate&gt;MIIDNDCCAhygAwIBAgIGAVgFivO1MA0GCSqGSIb3DQEBCwUAMFsxCzAJBgNVBAYTAklOMQswCQYDVQQIEwJVUDEOMAwGA1UEBxMFTm9pZGExDTALBgNVBAoTBFBpbmcxDTALBgNVBAsTBFBpbmcxETAPBgNVBAMTCFBpbmdDZXJ0MB4XDTE2MTAyNzA5NDkwMloXDTE3MTAyNzA5NDkwMlowWzELMAkGA1UEBhMCSU4xCzAJBgNVBAgTAlVQMQ4wDAYDVQQHEwVOb2lkYTENMAsGA1UEChMEUGluZzENMAsGA1UECxMEUGluZzERMA8GA1UEAxMIUGluZ0NlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDW1OC4pSwb11rUhA8JoZtkqXebWWaw9lZgXQmqFlIpMSbmeTNayQ+cAAtO+4QNLbtmZta1wEs+XJ4ho3Yy7EoaE+ebmiGnwBtqzq9ZHYqqT9RJ8kOaqZpYo/uXAtVPHE4/kH8xLY+lToF+EL4QG1gbi3CO/yTWMPnkGZOJDpcFvTRFWXCmLqgxvjrpt82bG58CUHiwx26vJO7q8OiMqiVIzzzrVqTR0XmyKtiV+5AfK5Qdl7Z9o8zMKl8O4+d/lWfhV21bcU/aj4Wcr3Os3SQm37OP9T4qhSFOWhGe+JOmW+dDUAFg/EeU0yOUF7/xaOk3D2No+SsrJiPogdVCGO2lAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAICZDjz9Hfccvqdo7LopyG+0bKor+Ybh60bzcTPblXSv5v7Zy4JRfQF/k0CbmV7bBTvZ+kgDWXZP4YakfIWivSEDnT+xnVkF+sRlOtLmwmJ3UDRVqRhR8V3aq7YkH4ltzG7B3oS05wpTrYHnb4xgOHx+isX4YzHVP+gHblU36Fo32vhLNoVi1G+7nlZY3iuug6Y9NU7HnppS8vMcRJn8dOvEykmPu/jiq72gcZIhnaszXIx7mJAy9qsg1iNuwSwjVhCRuP+o7xyUpaamlMxRRP2h3LpWGveXcidBe40uI6uFxE+ggE09F29GRCb7X9pPub+C+cnxg/rIKmrqxe/j1wU=&lt;/ds:X509Certificate&gt;&lt;/ds:X509Data&gt;&lt;/ds:KeyInfo&gt;&lt;/md:KeyDescriptor&gt;&lt;md:ArtifactResolutionService index="0" Location="https://localhost:9031/idp/ARS.ssaml2" Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" isDefault="true"/&gt;&lt;md:NameIDFormat&gt;urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified&lt;/md:NameIDFormat&gt;&lt;md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://localhost:9031/idp/SSO.saml2"/&gt;&lt;md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://localhost:9031/idp/SSO.saml2"/&gt;&lt;md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://localhost:9031/idp/SSO.saml2"/&gt;&lt;md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://localhost:9031/idp/SSO.saml2"/&gt;&lt;saml:Attribute Name="name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/&gt;&lt;saml:Attribute Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/&gt;&lt;/md:IDPSSODescriptor&gt;&lt;md:ContactPerson contactType="administrative"/&gt;&lt;/md:EntityDescriptor&gt;
</code></pre>