title: SAML Signature verification failed
body: <p>Our IdP is a Salesforce.com org. The SP is a third party .Net application. During development, the 3rd party reported that they're unable to validate the SAML response sent.</p>
  
  <p>We decided to try validating on our end using <a href="http://www.componentspace.com/products/samlv20.aspx" rel="nofollow">ComponentSpace</a> to validate the SAML response. Below is what we tried:</p>
  
  <pre><code>// Load the certificate from the file: certInFile
  // Load the SAML in an XMLElement: samlXml
  // Retrieve the certificate from the SAML: certInSaml
  
  Console.WriteLine("SAML is valid ? " + SAMLResponse.IsValid(samlXml));
  Console.WriteLine("Is SAML signed? " + SAMLMessageSignature.IsSigned(samlXml));
  Console.WriteLine("Certificate found in SAML is same as certificate file? " + certInFile.Equals(certInSaml));
  Console.WriteLine("Validated SAML with certificate found in SAML" + SAMLMessageSignature.Verify(samlXml, certInSaml));
  Console.WriteLine("Validated SAML with certificate file" + SAMLMessageSignature.Verify(samlXml, certInFile));
  </code></pre>
  
  <p>I'm getting true for everything above, except the last two. So:</p>
  
  <ol>
  <li>The SAML is valid</li>
  <li>The SAML has a valid signature</li>
  <li>The public key certificate in the SAML is the same as the certificate file we have</li>
  <li>The SAML is signed with the private key of neither the certificate file nor the public key sent in the SAML</li>
  </ol>
  
  <p>From 3,4 can we conclude that Salesforce is signing but with a different certificate but sending the wrong public key in the response?!</p>
  
  <p><strong>Edit</strong>: Sample SAML is here <a href="http://pastebin.com/J8FTxnhJ" rel="nofollow">http://pastebin.com/J8FTxnhJ</a></p>
  
  <p>What am I missing?</p>