We've setup SFDC as an IdP for SSO 2.0 with another .Net application. The ACS URL, for now, is configured as a VF page which just does a
System.debug() on the
We picked up the value from Debug Logs and tried to validate it using ComponentSpace, a .Net tool. This is what we found:
- The SAML is valid
- The SAML has a valid signature
- The public key certificate in the SAML is the same as the certificate file we download from the org
- BUT, the SAML is signed with the private key of neither the certificate file nor the public key sent in the SAML
From 3,4 can we conclude that Salesforce is signing but with a different certificate but sending the wrong public key in the response?!
Sample SAML is here http://pastebin.com/J8FTxnhJ
What am I missing?
We are able to validate the request if we don't decode it from Base64. But the information seems to be intact when we decode but still not valid (according to ComponentSpace)