Signature cannot be validated

[gabbydotCMS]

This is the issue we've been troubleshooting with a Shibboleth instance.

Let me know if you need additional information.

[gabbydotCMS]

[18/06/18 21:31:39:854 EDT] DEBUG filter.SamlAccessFilter: The user is in backend: false, is not logged: true
[18/06/18 21:31:39:857 EDT] DEBUG util.SiteIdpConfigResolver: Resolving the configuration: com.dotcms.plugin.saml.v3.config.IdpConfig@f2880ecb, for the site: saml-test.support.dotcmscloud.com, sites availables:saml-test.support.dotcmscloud.com
[18/06/18 21:31:39:857 EDT] DEBUG parameters.DotsamlPropertiesService: Found islogoutneed : true
[18/06/18 21:31:39:857 EDT] DEBUG parameters.DotsamlPropertiesService: Found access.filter.values : null
[18/06/18 21:31:39:857 EDT] DEBUG parameters.DotsamlPropertiesService: Found include.path.values : ^/dotsaml/login$,^/dotCMS/login.*$,^/html/portal/login.*$,^/c/public/login.*$,^/c/portal_public/login.*$,^/c/portal/logout.*$,^/dotCMS/logout.*$,^/application/login/login.*$,^/dotAdmin.*$
[18/06/18 21:31:39:857 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /c, with the pattern: ^/dotsaml/login$
[18/06/18 21:31:39:857 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /c, with the pattern: ^/dotCMS/login.*$
[18/06/18 21:31:39:857 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /c, with the pattern: ^/html/portal/login.*$
[18/06/18 21:31:39:857 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /c, with the pattern: ^/c/public/login.*$
[18/06/18 21:31:39:857 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /c, with the pattern: ^/c/portal_public/login.*$
[18/06/18 21:31:39:857 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /c, with the pattern: ^/c/portal/logout.*$
[18/06/18 21:31:39:857 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /c, with the pattern: ^/dotCMS/logout.*$
[18/06/18 21:31:39:857 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /c, with the pattern: ^/application/login/login.*$
[18/06/18 21:31:39:857 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /c, with the pattern: ^/dotAdmin.*$
[18/06/18 21:31:39:857 EDT] DEBUG filter.SamlAccessFilter: The uri: /c, include = false
[18/06/18 21:31:39:857 EDT] DEBUG parameters.DotsamlPropertiesService: Found logout.path.values : /c/portal/logout,/dotCMS/logout,/dotsaml/request/logout
[18/06/18 21:31:39:908 EDT] DEBUG filter.SamlAccessFilter: The user is in backend: true, is not logged: true
[18/06/18 21:31:39:914 EDT] DEBUG util.SiteIdpConfigResolver: Resolving the configuration: com.dotcms.plugin.saml.v3.config.IdpConfig@f2880ecb, for the site: saml-test.support.dotcmscloud.com, sites availables:saml-test.support.dotcmscloud.com
[18/06/18 21:31:39:914 EDT] DEBUG parameters.DotsamlPropertiesService: Found islogoutneed : true
[18/06/18 21:31:39:914 EDT] DEBUG parameters.DotsamlPropertiesService: Found access.filter.values : null
[18/06/18 21:31:39:914 EDT] DEBUG parameters.DotsamlPropertiesService: Found include.path.values : ^/dotsaml/login$,^/dotCMS/login.*$,^/html/portal/login.*$,^/c/public/login.*$,^/c/portal_public/login.*$,^/c/portal/logout.*$,^/dotCMS/logout.*$,^/application/login/login.*$,^/dotAdmin.*$
[18/06/18 21:31:39:914 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /html/portal/login.jsp, with the pattern: ^/dotsaml/login$
[18/06/18 21:31:39:914 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /html/portal/login.jsp, with the pattern: ^/dotCMS/login.*$
[18/06/18 21:31:39:914 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /html/portal/login.jsp, with the pattern: ^/html/portal/login.*$
[18/06/18 21:31:39:914 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /html/portal/login.jsp, with the pattern: ^/c/public/login.*$
[18/06/18 21:31:39:914 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /html/portal/login.jsp, with the pattern: ^/c/portal_public/login.*$
[18/06/18 21:31:39:914 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /html/portal/login.jsp, with the pattern: ^/c/portal/logout.*$
[18/06/18 21:31:39:914 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /html/portal/login.jsp, with the pattern: ^/dotCMS/logout.*$
[18/06/18 21:31:39:914 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /html/portal/login.jsp, with the pattern: ^/application/login/login.*$
[18/06/18 21:31:39:914 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /html/portal/login.jsp, with the pattern: ^/dotAdmin.*$
[18/06/18 21:31:39:914 EDT] DEBUG filter.SamlAccessFilter: The uri: /html/portal/login.jsp, include = true
[18/06/18 21:31:39:914 EDT] DEBUG filter.SamlAccessFilter: The user is in backend: true, is not logged: true
[18/06/18 21:31:39:914 EDT] DEBUG filter.SamlAccessFilter: User is not logged, processing saml request
[18/06/18 21:31:39:914 EDT] DEBUG filter.SamlAccessFilter: Mon Jun 18 20:31:39 EST 2018: SAML login request for host: (saml-test.support.dotcmscloud.com) site: 318508e4-6f20-4dec-805f-fa2f071e85ea (backend) from 75.74.193.239
[18/06/18 21:31:39:914 EDT] DEBUG filter.SamlAccessFilter: Doing Saml Login Redirection when request: /html/portal/login.jsp?r=1529371899859
[18/06/18 21:31:39:916 EDT] DEBUG util.SiteIdpConfigResolver: Resolving the configuration: com.dotcms.plugin.saml.v3.config.IdpConfig@f2880ecb, for the site: saml-test.support.dotcmscloud.com, sites availables:saml-test.support.dotcmscloud.com
[18/06/18 21:31:39:916 EDT] DEBUG parameters.DotsamlPropertiesService: Found bindingtype : urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
[18/06/18 21:31:39:916 EDT] DEBUG parameters.DotsamlPropertiesService: Found idp.metadata.parser.classname : null
[18/06/18 21:31:39:916 EDT] DEBUG util.InstanceUtil: Creating an instance of: com.dotcms.plugin.saml.v3.meta.DefaultMetaDescriptorServiceImpl
[18/06/18 21:31:39:916 EDT]  INFO meta.DefaultMetaDescriptorServiceImpl: unmarshall( final InputStream is ) metadata = has value
[18/06/18 21:31:39:916 EDT]  INFO meta.DefaultMetaDescriptorServiceImpl: unmarshall( final InputStream is ) unmarshaller = has value
[18/06/18 21:31:39:918 EDT] DEBUG parameters.DotsamlPropertiesService: Found idp.metadata.protocol : urn:oasis:names:tc:SAML:2.0:protocol
[18/06/18 21:31:39:918 EDT]  INFO meta.DefaultMetaDescriptorServiceImpl: Parsing the Id Provider, with the entityId: https://auth-test.uakron.edu/idp/shibboleth
[18/06/18 21:31:39:918 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:mace:shibboleth:1.0:profiles:AuthnRequest(https://auth-test.uakron.edu/idp/profile/Shibboleth/SSO)
[18/06/18 21:31:39:918 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST(https://auth-test.uakron.edu/idp/profile/SAML2/POST/SSO)
[18/06/18 21:31:39:918 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign(https://auth-test.uakron.edu/idp/profile/SAML2/POST-SimpleSign/SSO)
[18/06/18 21:31:39:918 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect(https://auth-test.uakron.edu/idp/profile/SAML2/Redirect/SSO)
[18/06/18 21:31:39:918 EDT] DEBUG parameters.DotsamlPropertiesService: Found protocol.binding : urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
[18/06/18 21:31:39:918 EDT] DEBUG parameters.DotsamlPropertiesService: Found policy.allowcreate : false
[18/06/18 21:31:39:918 EDT] DEBUG parameters.DotsamlPropertiesService: Found nameidpolicy.format : urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
[18/06/18 21:31:39:918 EDT] DEBUG parameters.DotsamlPropertiesService: Found authn.comparisontype : null
[18/06/18 21:31:39:918 EDT] DEBUG parameters.DotsamlPropertiesService: Found authn.context.class.ref : urn:oasis:names:tc:SAML:2.0:ac:classes:Password
[18/06/18 21:31:39:918 EDT] DEBUG parameters.DotsamlPropertiesService: Found force.authn : false
[18/06/18 21:31:39:918 EDT] DEBUG parameters.DotsamlPropertiesService: Found bindingtype : urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
[18/06/18 21:31:39:919 EDT] DEBUG parameters.DotsamlPropertiesService: Found idp.metadata.parser.classname : null
[18/06/18 21:31:39:919 EDT] DEBUG util.InstanceUtil: Creating an instance of: com.dotcms.plugin.saml.v3.meta.DefaultMetaDescriptorServiceImpl
[18/06/18 21:31:39:919 EDT]  INFO meta.DefaultMetaDescriptorServiceImpl: unmarshall( final InputStream is ) metadata = has value
[18/06/18 21:31:39:919 EDT]  INFO meta.DefaultMetaDescriptorServiceImpl: unmarshall( final InputStream is ) unmarshaller = has value
[18/06/18 21:31:39:920 EDT] DEBUG parameters.DotsamlPropertiesService: Found idp.metadata.protocol : urn:oasis:names:tc:SAML:2.0:protocol
[18/06/18 21:31:39:920 EDT]  INFO meta.DefaultMetaDescriptorServiceImpl: Parsing the Id Provider, with the entityId: https://auth-test.uakron.edu/idp/shibboleth
[18/06/18 21:31:39:920 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:mace:shibboleth:1.0:profiles:AuthnRequest(https://auth-test.uakron.edu/idp/profile/Shibboleth/SSO)
[18/06/18 21:31:39:920 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST(https://auth-test.uakron.edu/idp/profile/SAML2/POST/SSO)
[18/06/18 21:31:39:920 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign(https://auth-test.uakron.edu/idp/profile/SAML2/POST-SimpleSign/SSO)
[18/06/18 21:31:39:920 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect(https://auth-test.uakron.edu/idp/profile/SAML2/Redirect/SSO)
[18/06/18 21:31:39:923 EDT] DEBUG service.OpenSamlAuthenticationServiceImpl: XMLObject: <?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="https://saml-test.support.dotcmscloud.com/dotsaml/login/318508e4-6f20-4dec-805f-fa2f071e85ea" Destination="https://auth-test.uakron.edu/idp/profile/SAML2/Redirect/SSO" ForceAuthn="false" ID="_3f8aa40e6480a0a9b3b751c464c84fab" IssueInstant="2018-06-19T01:31:39.918Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://saml-test.support.dotcmscloud.com</saml2:Issuer>
<saml2p:NameIDPolicy AllowCreate="false" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
<saml2p:RequestedAuthnContext Comparison="minimum">
<saml2:AuthnContextClassRef xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef>
</saml2p:RequestedAuthnContext>
</saml2p:AuthnRequest>

[18/06/18 21:31:39:923 EDT] DEBUG service.OpenSamlAuthenticationServiceImpl: Redirecting to IDP
[18/06/18 21:31:59:763 EDT] DEBUG filter.SamlAccessFilter: The user is in backend: false, is not logged: true
[18/06/18 21:31:59:765 EDT] DEBUG util.SiteIdpConfigResolver: Resolving the configuration: com.dotcms.plugin.saml.v3.config.IdpConfig@f2880ecb, for the site: saml-test.support.dotcmscloud.com, sites availables:saml-test.support.dotcmscloud.com
[18/06/18 21:31:59:765 EDT] DEBUG parameters.DotsamlPropertiesService: Found islogoutneed : true
[18/06/18 21:31:59:765 EDT] DEBUG parameters.DotsamlPropertiesService: Found access.filter.values : null
[18/06/18 21:31:59:765 EDT] DEBUG parameters.DotsamlPropertiesService: Found include.path.values : ^/dotsaml/login$,^/dotCMS/login.*$,^/html/portal/login.*$,^/c/public/login.*$,^/c/portal_public/login.*$,^/c/portal/logout.*$,^/dotCMS/logout.*$,^/application/login/login.*$,^/dotAdmin.*$
[18/06/18 21:31:59:765 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /dotsaml/login/318508e4-6f20-4dec-805f-fa2f071e85ea, with the pattern: ^/dotsaml/login$
[18/06/18 21:31:59:765 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /dotsaml/login/318508e4-6f20-4dec-805f-fa2f071e85ea, with the pattern: ^/dotCMS/login.*$
[18/06/18 21:31:59:765 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /dotsaml/login/318508e4-6f20-4dec-805f-fa2f071e85ea, with the pattern: ^/html/portal/login.*$
[18/06/18 21:31:59:765 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /dotsaml/login/318508e4-6f20-4dec-805f-fa2f071e85ea, with the pattern: ^/c/public/login.*$
[18/06/18 21:31:59:765 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /dotsaml/login/318508e4-6f20-4dec-805f-fa2f071e85ea, with the pattern: ^/c/portal_public/login.*$
[18/06/18 21:31:59:765 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /dotsaml/login/318508e4-6f20-4dec-805f-fa2f071e85ea, with the pattern: ^/c/portal/logout.*$
[18/06/18 21:31:59:765 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /dotsaml/login/318508e4-6f20-4dec-805f-fa2f071e85ea, with the pattern: ^/dotCMS/logout.*$
[18/06/18 21:31:59:765 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /dotsaml/login/318508e4-6f20-4dec-805f-fa2f071e85ea, with the pattern: ^/application/login/login.*$
[18/06/18 21:31:59:765 EDT] DEBUG filter.SamlAccessFilter: Evaluating the uri: /dotsaml/login/318508e4-6f20-4dec-805f-fa2f071e85ea, with the pattern: ^/dotAdmin.*$
[18/06/18 21:31:59:765 EDT] DEBUG filter.SamlAccessFilter: The uri: /dotsaml/login/318508e4-6f20-4dec-805f-fa2f071e85ea, include = false
[18/06/18 21:31:59:765 EDT] DEBUG parameters.DotsamlPropertiesService: Found logout.path.values : /c/portal/logout,/dotCMS/logout,/dotsaml/request/logout
[18/06/18 21:31:59:768 EDT] DEBUG util.InstanceUtil: Creating an instance of: com.dotcms.plugin.saml.v3.service.OpenSamlAuthenticationServiceImpl
[18/06/18 21:31:59:769 EDT] DEBUG filter.SamlFilter: Mon Jun 18 20:31:59 EST 2018: SAML login request for host: (saml-test.support.dotcmscloud.com) site: 318508e4-6f20-4dec-805f-fa2f071e85ea (backend) from 75.74.193.239
[18/06/18 21:31:59:769 EDT] DEBUG parameters.DotsamlPropertiesService: Found assertion.resolver.handler.classname : null
[18/06/18 21:31:59:769 EDT] DEBUG handler.AssertionResolverHandlerFactory: Getting the assertion resolver for the idpConfig: 318508e4-6f20-4dec-805f-fa2f071e85ea, with the class: com.dotcms.plugin.saml.v3.handler.HttpPostAssertionResolverHandlerImpl@76dfc8ea
[18/06/18 21:31:59:769 EDT] DEBUG handler.HttpPostAssertionResolverHandlerImpl: Resolving the Artifact with the implementation: class com.dotcms.plugin.saml.v3.handler.HttpPostAssertionResolverHandlerImpl
[18/06/18 21:31:59:769 EDT] DEBUG handler.HttpPostAssertionResolverHandlerImpl: Decoding the Post message: PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPHNhbWwycDpSZXNwb25zZSBEZXN0aW5hdGlvbj0iaHR0cHM6Ly9zYW1sLXRlc3Quc3VwcG9ydC5kb3RjbXNjbG91ZC5jb20vZG90c2FtbC9sb2dpbi8zMTg1MDhlNC02ZjIwLTRkZWMtODA1Zi1mYTJmMDcxZTg1ZWEiIElEPSJfNjhhNmU0MzkxMjE5MTA4NzY5ZjYxNWUyZDZjMzVlM2MiIEluUmVzcG9uc2VUbz0iXzNmOGFhNDBlNjQ4MGEwYTliM2I3NTFjNDY0Yzg0ZmFiIiBJc3N1ZUluc3RhbnQ9IjIwMTgtMDYtMTlUMDE6MzE6NTEuNzk5WiIgVmVyc2lvbj0iMi4wIiB4bWxuczpzYW1sMnA9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpwcm90b2NvbCI+PHNhbWwyOklzc3VlciB4bWxuczpzYW1sMj0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+aHR0cHM6Ly9hdXRoLXRlc3QudWFrcm9uLmVkdS9pZHAvc2hpYmJvbGV0aDwvc2FtbDI6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPgo8ZHM6U2lnbmVkSW5mbz4KPGRzOkNhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz4KPGRzOlNpZ25hdHVyZU1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZHNpZy1tb3JlI3JzYS1zaGEyNTYiLz4KPGRzOlJlZmVyZW5jZSBVUkk9IiNfNjhhNmU0MzkxMjE5MTA4NzY5ZjYxNWUyZDZjMzVlM2MiPgo8ZHM6VHJhbnNmb3Jtcz4KPGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8+CjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz4KPC9kczpUcmFuc2Zvcm1zPgo8ZHM6RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjc2hhMjU2Ii8+CjxkczpEaWdlc3RWYWx1ZT5lNFFqSCtsd08xSHVDZzVMRWlYS05iM2RxL2VBNmZ6VGcrc1I3Zzl6Ny9RPTwvZHM6RGlnZXN0VmFsdWU+CjwvZHM6UmVmZXJlbmNlPgo8L2RzOlNpZ25lZEluZm8+CjxkczpTaWduYXR1cmVWYWx1ZT4KWTdLVTNSTENSVWdDVlV4RmtpMi9UM2EzcExkOHNGem5wUE5JQ0FrTlFNaTQ2Qk9WNVMyM2FUVFdva3JrWkFkcWQ5NUQvdHdLMERvYwpwQTlodmZ5RUZMVGEzeWxZVG5Qa1ZVaWxOS05qalBUeVZHaTBldXRWKzVvSlBsTDh4djYySHVieU43VXBEdmU5cXNLTWFiQkdOZ0lRCjJ3WVBZNUlXWHpFY1cxUXp3OVhYUVhuTXk2VW5xa2llVXpacjZzcEs5VUxUSzFOazR2dEhwbFAveHhyT0Y5cHloemlTZnhweVZsa0YKajFzOW9xemtILzEwSy9zcUsxSjFwSk5UQXZoRE5CT3JHcXl2M2JPaHljd3RGQlRaSUZJYXg2UVg3WlJJT0RES2VMcUE5UXRMSWtSOQpOYnhlWCs3U29ia3VsRVdQekxrNk5hVU9tMHQ1SHY0TmRWUXlEZz09CjwvZHM6U2lnbmF0dXJlVmFsdWU+CjxkczpLZXlJbmZvPjxkczpYNTA5RGF0YT48ZHM6WDUwOUNlcnRpZmljYXRlPk1JSURPekNDQWlPZ0F3SUJBZ0lVQktjUHdTTk1uYVNvNTI0ZEpxck1pYmZQelN3d0RRWUpLb1pJaHZjTkFRRUZCUUF3SHpFZE1Cc0cKQTFVRUF4TVVZWFYwYUMxMFpYTjBMblZoYTNKdmJpNWxaSFV3SGhjTk1URXdNakE0TWpFME16TTBXaGNOTXpFd01qQTRNakUwTXpNMApXakFmTVIwd0d3WURWUVFERXhSaGRYUm9MWFJsYzNRdWRXRnJjbTl1TG1Wa2RUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQCkFEQ0NBUW9DZ2dFQkFMT1VHeDROQ3oyTHYydkhDdU0reVNFOVZjMjFIYk1vVWpYWmFFaDdaUmt5Zm5mNCszTFA2R2FJK1hZZFNZNzkKWXRiaUVVL3JqcVBIT2h1Qi9CaUxTS2xDSFJ1OEJ1SVd2N3dONjNJeHFsc1ZtdFlmbHRzYkw4a0JFdVdkbmJWMWFyU1gvSVdkSmlEawo2dDdQa2N4WDFKNVNkOHl4cUFQR0V0MXIzS29Bbm53dkw0M0tSRVVsWmhOKzZ2V0I4Yyt4KzNITGkwTktabkVrVDF3Qm5JeVRJbXFMCjlURGQwbE8rUHJKbEpWcS80K0k5cnJJS1RHREFGU3Bta0YxMS9tN0N6U25zU3AwMCtsVjd3dTN3QXFsQkZFOHl4MVUxbFRTcmJMZ3EKdU9rblpKeHRvd3ZiUFFmNFVCR0N6b01rcXJuMTM4WWtSUjJlVFZqaFFLcGFCeVkydnFjQ0F3RUFBYU52TUcwd1RBWURWUjBSQkVVdwpRNElVWVhWMGFDMTBaWE4wTG5WaGEzSnZiaTVsWkhXR0syaDBkSEJ6T2k4dllYVjBhQzEwWlhOMExuVmhhM0p2Ymk1bFpIVXZhV1J3CkwzTm9hV0ppYjJ4bGRHZ3dIUVlEVlIwT0JCWUVGT2YwSzhuTDZFMzl4bGNpWm1nZDhwUitxY3dOTUEwR0NTcUdTSWIzRFFFQkJRVUEKQTRJQkFRQ0FrTXp6RFhHTDFnR0dhRmU0RGJyWmM5Y01lcURlTzB5REJEYVlVUWdjdHlxalVHZmJYR0NPcmpON3drT2JCQjZhelo1ZQpkTUY2VVRBc0NBTHlSQkQ2VTdGMnhwZTI3bmsyRUVqS1lnZjZuT2ZTWVVPaFNYd1Njckt4eUR5ekQrd04zcEp4TVUzUXNCZXluTVFWCmtWS2RFU1dwY1BJY05wMTVlbC93Q05IZnRka3lqcE92OXpGWG1PWk9ZZ3UzMnVhRHl1Z1ZSSFNOaWQ5d1JaTnBNTjNwMUZ4Z1RPMmkKOG53djNLcjNvM3BmN3JiQzd4K0tSbUE3eDA4d3h0NXp5S2xGNXZydDRveW5Yc09zVkdtdFRCRzRvc21iODBTQXlOLzN4eU1lTjBGagpLZ2I0ZWRqTlcrZnJ4bTA3VWEyZW1Ubk9RcHVEa0I1WWt1WlFYZ21vZ1RFVzwvZHM6WDUwOUNlcnRpZmljYXRlPjwvZHM6WDUwOURhdGE+PC9kczpLZXlJbmZvPjwvZHM6U2lnbmF0dXJlPjxzYW1sMnA6U3RhdHVzPjxzYW1sMnA6U3RhdHVzQ29kZSBWYWx1ZT0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnN0YXR1czpTdWNjZXNzIi8+PC9zYW1sMnA6U3RhdHVzPjxzYW1sMjpBc3NlcnRpb24gSUQ9Il80OTgwNDcwOWI4ODZmYWY5NDdmMTNjYzM4YzljNGU3NSIgSXNzdWVJbnN0YW50PSIyMDE4LTA2LTE5VDAxOjMxOjUxLjc5OVoiIFZlcnNpb249IjIuMCIgeG1sbnM6c2FtbDI9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iPjxzYW1sMjpJc3N1ZXI+aHR0cHM6Ly9hdXRoLXRlc3QudWFrcm9uLmVkdS9pZHAvc2hpYmJvbGV0aDwvc2FtbDI6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPgo8ZHM6U2lnbmVkSW5mbz4KPGRzOkNhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz4KPGRzOlNpZ25hdHVyZU1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZHNpZy1tb3JlI3JzYS1zaGEyNTYiLz4KPGRzOlJlZmVyZW5jZSBVUkk9IiNfNDk4MDQ3MDliODg2ZmFmOTQ3ZjEzY2MzOGM5YzRlNzUiPgo8ZHM6VHJhbnNmb3Jtcz4KPGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8+CjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz4KPC9kczpUcmFuc2Zvcm1zPgo8ZHM6RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjc2hhMjU2Ii8+CjxkczpEaWdlc3RWYWx1ZT5BblpaL2ZZN2x2WHU1VEhyb1VlL2lEcHVJS0NORGJWRjhKeC91N2xFcXlvPTwvZHM6RGlnZXN0VmFsdWU+CjwvZHM6UmVmZXJlbmNlPgo8L2RzOlNpZ25lZEluZm8+CjxkczpTaWduYXR1cmVWYWx1ZT4KUC9VTXEzNnJ1SGxOQ0E3WWVIM2YrSnJUcjY3eGVDYTVvbW1PaGVleTdmb2o3clVjZktJSHkwR3JlQ2ZpZ3FiVzJxVzFqOTRvZm44YwpnZnFCbjJXUitTQ1dLS0lsb1FuUjJqUC9BZWFPeTJpc0toRSsyMXNJQkZPQU81bFR6Yi9oaDFjbkJlVGd1eHRaeWNMWG83OWY2NWRrCldOa3hHeCtVaFlGODZsUFlESzJOSTVxdEFyZldpQXBXVFhlNlZ6Q2tVN0pMNWFRRktCd09OcDNUZmkzVTk5TlBrQVZUcGw4dG4wUDAKRUlOWW9HZ0s5NUdRci9oSk4yeHpiaS9tVUJGU3RDSExzSXBXZktlbVhxLytmVVVOSWhhSzYyTXJtejBpUGgyeWxXVTVGWjVXYnlCWgowL0RBSytzejlQUlc5a2g5UDFpR3ZNVTJyT2V1bk9aN0kwamlPdz09CjwvZHM6U2lnbmF0dXJlVmFsdWU+CjxkczpLZXlJbmZvPjxkczpYNTA5RGF0YT48ZHM6WDUwOUNlcnRpZmljYXRlPk1JSURPekNDQWlPZ0F3SUJBZ0lVQktjUHdTTk1uYVNvNTI0ZEpxck1pYmZQelN3d0RRWUpLb1pJaHZjTkFRRUZCUUF3SHpFZE1Cc0cKQTFVRUF4TVVZWFYwYUMxMFpYTjBMblZoYTNKdmJpNWxaSFV3SGhjTk1URXdNakE0TWpFME16TTBXaGNOTXpFd01qQTRNakUwTXpNMApXakFmTVIwd0d3WURWUVFERXhSaGRYUm9MWFJsYzNRdWRXRnJjbTl1TG1Wa2RUQ0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQCkFEQ0NBUW9DZ2dFQkFMT1VHeDROQ3oyTHYydkhDdU0reVNFOVZjMjFIYk1vVWpYWmFFaDdaUmt5Zm5mNCszTFA2R2FJK1hZZFNZNzkKWXRiaUVVL3JqcVBIT2h1Qi9CaUxTS2xDSFJ1OEJ1SVd2N3dONjNJeHFsc1ZtdFlmbHRzYkw4a0JFdVdkbmJWMWFyU1gvSVdkSmlEawo2dDdQa2N4WDFKNVNkOHl4cUFQR0V0MXIzS29Bbm53dkw0M0tSRVVsWmhOKzZ2V0I4Yyt4KzNITGkwTktabkVrVDF3Qm5JeVRJbXFMCjlURGQwbE8rUHJKbEpWcS80K0k5cnJJS1RHREFGU3Bta0YxMS9tN0N6U25zU3AwMCtsVjd3dTN3QXFsQkZFOHl4MVUxbFRTcmJMZ3EKdU9rblpKeHRvd3ZiUFFmNFVCR0N6b01rcXJuMTM4WWtSUjJlVFZqaFFLcGFCeVkydnFjQ0F3RUFBYU52TUcwd1RBWURWUjBSQkVVdwpRNElVWVhWMGFDMTBaWE4wTG5WaGEzSnZiaTVsWkhXR0syaDBkSEJ6T2k4dllYVjBhQzEwWlhOMExuVmhhM0p2Ymk1bFpIVXZhV1J3CkwzTm9hV0ppYjJ4bGRHZ3dIUVlEVlIwT0JCWUVGT2YwSzhuTDZFMzl4bGNpWm1nZDhwUitxY3dOTUEwR0NTcUdTSWIzRFFFQkJRVUEKQTRJQkFRQ0FrTXp6RFhHTDFnR0dhRmU0RGJyWmM5Y01lcURlTzB5REJEYVlVUWdjdHlxalVHZmJYR0NPcmpON3drT2JCQjZhelo1ZQpkTUY2VVRBc0NBTHlSQkQ2VTdGMnhwZTI3bmsyRUVqS1lnZjZuT2ZTWVVPaFNYd1Njckt4eUR5ekQrd04zcEp4TVUzUXNCZXluTVFWCmtWS2RFU1dwY1BJY05wMTVlbC93Q05IZnRka3lqcE92OXpGWG1PWk9ZZ3UzMnVhRHl1Z1ZSSFNOaWQ5d1JaTnBNTjNwMUZ4Z1RPMmkKOG53djNLcjNvM3BmN3JiQzd4K0tSbUE3eDA4d3h0NXp5S2xGNXZydDRveW5Yc09zVkdtdFRCRzRvc21iODBTQXlOLzN4eU1lTjBGagpLZ2I0ZWRqTlcrZnJ4bTA3VWEyZW1Ubk9RcHVEa0I1WWt1WlFYZ21vZ1RFVzwvZHM6WDUwOUNlcnRpZmljYXRlPjwvZHM6WDUwOURhdGE+PC9kczpLZXlJbmZvPjwvZHM6U2lnbmF0dXJlPjxzYW1sMjpTdWJqZWN0PjxzYW1sMjpOYW1lSUQgRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6bmFtZWlkLWZvcm1hdDpwZXJzaXN0ZW50IiBOYW1lUXVhbGlmaWVyPSJodHRwczovL2F1dGgtdGVzdC51YWtyb24uZWR1L2lkcC9zaGliYm9sZXRoIiBTUE5hbWVRdWFsaWZpZXI9Imh0dHBzOi8vc2FtbC10ZXN0LnN1cHBvcnQuZG90Y21zY2xvdWQuY29tIj5wVjZZbzREYWZ4Sks2ajVJK0NOeWZnSEdNamM9PC9zYW1sMjpOYW1lSUQ+PHNhbWwyOlN1YmplY3RDb25maXJtYXRpb24gTWV0aG9kPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6Y206YmVhcmVyIj48c2FtbDI6U3ViamVjdENvbmZpcm1hdGlvbkRhdGEgQWRkcmVzcz0iNzUuNzQuMTkzLjIzOSIgSW5SZXNwb25zZVRvPSJfM2Y4YWE0MGU2NDgwYTBhOWIzYjc1MWM0NjRjODRmYWIiIE5vdE9uT3JBZnRlcj0iMjAxOC0wNi0xOVQwMTozNjo1MS44MzJaIiBSZWNpcGllbnQ9Imh0dHBzOi8vc2FtbC10ZXN0LnN1cHBvcnQuZG90Y21zY2xvdWQuY29tL2RvdHNhbWwvbG9naW4vMzE4NTA4ZTQtNmYyMC00ZGVjLTgwNWYtZmEyZjA3MWU4NWVhIi8+PC9zYW1sMjpTdWJqZWN0Q29uZmlybWF0aW9uPjwvc2FtbDI6U3ViamVjdD48c2FtbDI6Q29uZGl0aW9ucyBOb3RCZWZvcmU9IjIwMTgtMDYtMTlUMDE6MzE6NTEuNzk5WiIgTm90T25PckFmdGVyPSIyMDE4LTA2LTE5VDAxOjM2OjUxLjc5OVoiPjxzYW1sMjpBdWRpZW5jZVJlc3RyaWN0aW9uPjxzYW1sMjpBdWRpZW5jZT5odHRwczovL3NhbWwtdGVzdC5zdXBwb3J0LmRvdGNtc2Nsb3VkLmNvbTwvc2FtbDI6QXVkaWVuY2U+PC9zYW1sMjpBdWRpZW5jZVJlc3RyaWN0aW9uPjwvc2FtbDI6Q29uZGl0aW9ucz48c2FtbDI6QXV0aG5TdGF0ZW1lbnQgQXV0aG5JbnN0YW50PSIyMDE4LTA2LTE5VDAxOjMxOjUxLjU2OFoiIFNlc3Npb25JbmRleD0iX2Y0NzY5YzRlZTY5NzczODViOTEzZmFjNmM1YTNjMmZkIj48c2FtbDI6U3ViamVjdExvY2FsaXR5IEFkZHJlc3M9Ijc1Ljc0LjE5My4yMzkiLz48c2FtbDI6QXV0aG5Db250ZXh0PjxzYW1sMjpBdXRobkNvbnRleHRDbGFzc1JlZj51cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YWM6Y2xhc3NlczpQYXNzd29yZDwvc2FtbDI6QXV0aG5Db250ZXh0Q2xhc3NSZWY+PC9zYW1sMjpBdXRobkNvbnRleHQ+PC9zYW1sMjpBdXRoblN0YXRlbWVudD48L3NhbWwyOkFzc2VydGlvbj48L3NhbWwycDpSZXNwb25zZT4=
[18/06/18 21:31:59:778 EDT] DEBUG handler.HttpPostAssertionResolverHandlerImpl: Post message context decoded: <?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://saml-test.support.dotcmscloud.com/dotsaml/login/318508e4-6f20-4dec-805f-fa2f071e85ea" ID="_68a6e4391219108769f615e2d6c35e3c" InResponseTo="_3f8aa40e6480a0a9b3b751c464c84fab" IssueInstant="2018-06-19T01:31:51.799Z" Version="2.0">
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://auth-test.uakron.edu/idp/shibboleth</saml2:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="#_68a6e4391219108769f615e2d6c35e3c">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>e4QjH+lwO1HuCg5LEiXKNb3dq/eA6fzTg+sR7g9z7/Q=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
Y7KU3RLCRUgCVUxFki2/T3a3pLd8sFznpPNICAkNQMi46BOV5S23aTTWokrkZAdqd95D/twK0Doc
pA9hvfyEFLTa3ylYTnPkVUilNKNjjPTyVGi0eutV+5oJPlL8xv62HubyN7UpDve9qsKMabBGNgIQ
2wYPY5IWXzEcW1Qzw9XXQXnMy6UnqkieUzZr6spK9ULTK1Nk4vtHplP/xxrOF9pyhziSfxpyVlkF
j1s9oqzkH/10K/sqK1J1pJNTAvhDNBOrGqyv3bOhycwtFBTZIFIax6QX7ZRIODDKeLqA9QtLIkR9
NbxeX+7SobkulEWPzLk6NaUOm0t5Hv4NdVQyDg==
</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>MIIDOzCCAiOgAwIBAgIUBKcPwSNMnaSo524dJqrMibfPzSwwDQYJKoZIhvcNAQEFBQAwHzEdMBsG
A1UEAxMUYXV0aC10ZXN0LnVha3Jvbi5lZHUwHhcNMTEwMjA4MjE0MzM0WhcNMzEwMjA4MjE0MzM0
WjAfMR0wGwYDVQQDExRhdXRoLXRlc3QudWFrcm9uLmVkdTCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBALOUGx4NCz2Lv2vHCuM+ySE9Vc21HbMoUjXZaEh7ZRkyfnf4+3LP6GaI+XYdSY79
YtbiEU/rjqPHOhuB/BiLSKlCHRu8BuIWv7wN63IxqlsVmtYfltsbL8kBEuWdnbV1arSX/IWdJiDk
6t7PkcxX1J5Sd8yxqAPGEt1r3KoAnnwvL43KREUlZhN+6vWB8c+x+3HLi0NKZnEkT1wBnIyTImqL
9TDd0lO+PrJlJVq/4+I9rrIKTGDAFSpmkF11/m7CzSnsSp00+lV7wu3wAqlBFE8yx1U1lTSrbLgq
uOknZJxtowvbPQf4UBGCzoMkqrn138YkRR2eTVjhQKpaByY2vqcCAwEAAaNvMG0wTAYDVR0RBEUw
Q4IUYXV0aC10ZXN0LnVha3Jvbi5lZHWGK2h0dHBzOi8vYXV0aC10ZXN0LnVha3Jvbi5lZHUvaWRw
L3NoaWJib2xldGgwHQYDVR0OBBYEFOf0K8nL6E39xlciZmgd8pR+qcwNMA0GCSqGSIb3DQEBBQUA
A4IBAQCAkMzzDXGL1gGGaFe4DbrZc9cMeqDeO0yDBDaYUQgctyqjUGfbXGCOrjN7wkObBB6azZ5e
dMF6UTAsCALyRBD6U7F2xpe27nk2EEjKYgf6nOfSYUOhSXwScrKxyDyzD+wN3pJxMU3QsBeynMQV
kVKdESWpcPIcNp15el/wCNHftdkyjpOv9zFXmOZOYgu32uaDyugVRHSNid9wRZNpMN3p1FxgTO2i
8nwv3Kr3o3pf7rbC7x+KRmA7x08wxt5zyKlF5vrt4oynXsOsVGmtTBG4osmb80SAyN/3xyMeN0Fj
Kgb4edjNW+frxm07Ua2emTnOQpuDkB5YkuZQXgmogTEW</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<saml2p:Status>
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
</saml2p:Status>
<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_49804709b886faf947f13cc38c9c4e75" IssueInstant="2018-06-19T01:31:51.799Z" Version="2.0">
<saml2:Issuer>https://auth-test.uakron.edu/idp/shibboleth</saml2:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="#_49804709b886faf947f13cc38c9c4e75">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>AnZZ/fY7lvXu5THroUe/iDpuIKCNDbVF8Jx/u7lEqyo=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
P/UMq36ruHlNCA7YeH3f+JrTr67xeCa5ommOheey7foj7rUcfKIHy0GreCfigqbW2qW1j94ofn8c
gfqBn2WR+SCWKKIloQnR2jP/AeaOy2isKhE+21sIBFOAO5lTzb/hh1cnBeTguxtZycLXo79f65dk
WNkxGx+UhYF86lPYDK2NI5qtArfWiApWTXe6VzCkU7JL5aQFKBwONp3Tfi3U99NPkAVTpl8tn0P0
EINYoGgK95GQr/hJN2xzbi/mUBFStCHLsIpWfKemXq/+fUUNIhaK62Mrmz0iPh2ylWU5FZ5WbyBZ
0/DAK+sz9PRW9kh9P1iGvMU2rOeunOZ7I0jiOw==
</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>MIIDOzCCAiOgAwIBAgIUBKcPwSNMnaSo524dJqrMibfPzSwwDQYJKoZIhvcNAQEFBQAwHzEdMBsG
A1UEAxMUYXV0aC10ZXN0LnVha3Jvbi5lZHUwHhcNMTEwMjA4MjE0MzM0WhcNMzEwMjA4MjE0MzM0
WjAfMR0wGwYDVQQDExRhdXRoLXRlc3QudWFrcm9uLmVkdTCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBALOUGx4NCz2Lv2vHCuM+ySE9Vc21HbMoUjXZaEh7ZRkyfnf4+3LP6GaI+XYdSY79
YtbiEU/rjqPHOhuB/BiLSKlCHRu8BuIWv7wN63IxqlsVmtYfltsbL8kBEuWdnbV1arSX/IWdJiDk
6t7PkcxX1J5Sd8yxqAPGEt1r3KoAnnwvL43KREUlZhN+6vWB8c+x+3HLi0NKZnEkT1wBnIyTImqL
9TDd0lO+PrJlJVq/4+I9rrIKTGDAFSpmkF11/m7CzSnsSp00+lV7wu3wAqlBFE8yx1U1lTSrbLgq
uOknZJxtowvbPQf4UBGCzoMkqrn138YkRR2eTVjhQKpaByY2vqcCAwEAAaNvMG0wTAYDVR0RBEUw
Q4IUYXV0aC10ZXN0LnVha3Jvbi5lZHWGK2h0dHBzOi8vYXV0aC10ZXN0LnVha3Jvbi5lZHUvaWRw
L3NoaWJib2xldGgwHQYDVR0OBBYEFOf0K8nL6E39xlciZmgd8pR+qcwNMA0GCSqGSIb3DQEBBQUA
A4IBAQCAkMzzDXGL1gGGaFe4DbrZc9cMeqDeO0yDBDaYUQgctyqjUGfbXGCOrjN7wkObBB6azZ5e
dMF6UTAsCALyRBD6U7F2xpe27nk2EEjKYgf6nOfSYUOhSXwScrKxyDyzD+wN3pJxMU3QsBeynMQV
kVKdESWpcPIcNp15el/wCNHftdkyjpOv9zFXmOZOYgu32uaDyugVRHSNid9wRZNpMN3p1FxgTO2i
8nwv3Kr3o3pf7rbC7x+KRmA7x08wxt5zyKlF5vrt4oynXsOsVGmtTBG4osmb80SAyN/3xyMeN0Fj
Kgb4edjNW+frxm07Ua2emTnOQpuDkB5YkuZQXgmogTEW</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<saml2:Subject>
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://auth-test.uakron.edu/idp/shibboleth" SPNameQualifier="https://saml-test.support.dotcmscloud.com">pV6Yo4DafxJK6j5I+CNyfgHGMjc=</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address="75.74.193.239" InResponseTo="_3f8aa40e6480a0a9b3b751c464c84fab" NotOnOrAfter="2018-06-19T01:36:51.832Z" Recipient="https://saml-test.support.dotcmscloud.com/dotsaml/login/318508e4-6f20-4dec-805f-fa2f071e85ea"/>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2018-06-19T01:31:51.799Z" NotOnOrAfter="2018-06-19T01:36:51.799Z">
<saml2:AudienceRestriction>
<saml2:Audience>https://saml-test.support.dotcmscloud.com</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2018-06-19T01:31:51.568Z" SessionIndex="_f4769c4ee6977385b913fac6c5a3c2fd">
<saml2:SubjectLocality Address="75.74.193.239"/>
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
</saml2:Assertion>
</saml2p:Response>

[18/06/18 21:31:59:788 EDT] DEBUG parameters.DotsamlPropertiesService: Found clock.skew : 10000
[18/06/18 21:31:59:788 EDT] DEBUG parameters.DotsamlPropertiesService: Found message.life.time : 30000
[18/06/18 21:31:59:788 EDT] DEBUG parameters.DotsamlPropertiesService: Found isassertion.encrypted : false
[18/06/18 21:31:59:790 EDT] DEBUG handler.HttpPostAssertionResolverHandlerImpl: Decrypted Assertion: <?xml version="1.0" encoding="UTF-8"?>
<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_49804709b886faf947f13cc38c9c4e75" IssueInstant="2018-06-19T01:31:51.799Z" Version="2.0">
<saml2:Issuer>https://auth-test.uakron.edu/idp/shibboleth</saml2:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="#_49804709b886faf947f13cc38c9c4e75">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>AnZZ/fY7lvXu5THroUe/iDpuIKCNDbVF8Jx/u7lEqyo=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
P/UMq36ruHlNCA7YeH3f+JrTr67xeCa5ommOheey7foj7rUcfKIHy0GreCfigqbW2qW1j94ofn8c
gfqBn2WR+SCWKKIloQnR2jP/AeaOy2isKhE+21sIBFOAO5lTzb/hh1cnBeTguxtZycLXo79f65dk
WNkxGx+UhYF86lPYDK2NI5qtArfWiApWTXe6VzCkU7JL5aQFKBwONp3Tfi3U99NPkAVTpl8tn0P0
EINYoGgK95GQr/hJN2xzbi/mUBFStCHLsIpWfKemXq/+fUUNIhaK62Mrmz0iPh2ylWU5FZ5WbyBZ
0/DAK+sz9PRW9kh9P1iGvMU2rOeunOZ7I0jiOw==
</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>MIIDOzCCAiOgAwIBAgIUBKcPwSNMnaSo524dJqrMibfPzSwwDQYJKoZIhvcNAQEFBQAwHzEdMBsG
A1UEAxMUYXV0aC10ZXN0LnVha3Jvbi5lZHUwHhcNMTEwMjA4MjE0MzM0WhcNMzEwMjA4MjE0MzM0
WjAfMR0wGwYDVQQDExRhdXRoLXRlc3QudWFrcm9uLmVkdTCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBALOUGx4NCz2Lv2vHCuM+ySE9Vc21HbMoUjXZaEh7ZRkyfnf4+3LP6GaI+XYdSY79
YtbiEU/rjqPHOhuB/BiLSKlCHRu8BuIWv7wN63IxqlsVmtYfltsbL8kBEuWdnbV1arSX/IWdJiDk
6t7PkcxX1J5Sd8yxqAPGEt1r3KoAnnwvL43KREUlZhN+6vWB8c+x+3HLi0NKZnEkT1wBnIyTImqL
9TDd0lO+PrJlJVq/4+I9rrIKTGDAFSpmkF11/m7CzSnsSp00+lV7wu3wAqlBFE8yx1U1lTSrbLgq
uOknZJxtowvbPQf4UBGCzoMkqrn138YkRR2eTVjhQKpaByY2vqcCAwEAAaNvMG0wTAYDVR0RBEUw
Q4IUYXV0aC10ZXN0LnVha3Jvbi5lZHWGK2h0dHBzOi8vYXV0aC10ZXN0LnVha3Jvbi5lZHUvaWRw
L3NoaWJib2xldGgwHQYDVR0OBBYEFOf0K8nL6E39xlciZmgd8pR+qcwNMA0GCSqGSIb3DQEBBQUA
A4IBAQCAkMzzDXGL1gGGaFe4DbrZc9cMeqDeO0yDBDaYUQgctyqjUGfbXGCOrjN7wkObBB6azZ5e
dMF6UTAsCALyRBD6U7F2xpe27nk2EEjKYgf6nOfSYUOhSXwScrKxyDyzD+wN3pJxMU3QsBeynMQV
kVKdESWpcPIcNp15el/wCNHftdkyjpOv9zFXmOZOYgu32uaDyugVRHSNid9wRZNpMN3p1FxgTO2i
8nwv3Kr3o3pf7rbC7x+KRmA7x08wxt5zyKlF5vrt4oynXsOsVGmtTBG4osmb80SAyN/3xyMeN0Fj
Kgb4edjNW+frxm07Ua2emTnOQpuDkB5YkuZQXgmogTEW</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<saml2:Subject>
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://auth-test.uakron.edu/idp/shibboleth" SPNameQualifier="https://saml-test.support.dotcmscloud.com">pV6Yo4DafxJK6j5I+CNyfgHGMjc=</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address="75.74.193.239" InResponseTo="_3f8aa40e6480a0a9b3b751c464c84fab" NotOnOrAfter="2018-06-19T01:36:51.832Z" Recipient="https://saml-test.support.dotcmscloud.com/dotsaml/login/318508e4-6f20-4dec-805f-fa2f071e85ea"/>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2018-06-19T01:31:51.799Z" NotOnOrAfter="2018-06-19T01:36:51.799Z">
<saml2:AudienceRestriction>
<saml2:Audience>https://saml-test.support.dotcmscloud.com</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2018-06-19T01:31:51.568Z" SessionIndex="_f4769c4ee6977385b913fac6c5a3c2fd">
<saml2:SubjectLocality Address="75.74.193.239"/>
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
</saml2:Assertion>

[18/06/18 21:31:59:790 EDT] DEBUG parameters.DotsamlPropertiesService: Found verify.signature.profile : true
[18/06/18 21:31:59:790 EDT] DEBUG util.SamlUtils: Doing Profile Validation
[18/06/18 21:31:59:796 EDT] DEBUG util.SamlUtils: Done Profile Validation
[18/06/18 21:31:59:797 EDT] DEBUG parameters.DotsamlPropertiesService: Found verify.signature.credentials : true
[18/06/18 21:31:59:797 EDT] DEBUG parameters.DotsamlPropertiesService: Found idp.metadata.parser.classname : null
[18/06/18 21:31:59:797 EDT] DEBUG util.InstanceUtil: Creating an instance of: com.dotcms.plugin.saml.v3.meta.DefaultMetaDescriptorServiceImpl
[18/06/18 21:31:59:798 EDT]  INFO meta.DefaultMetaDescriptorServiceImpl: unmarshall( final InputStream is ) metadata = has value
[18/06/18 21:31:59:798 EDT]  INFO meta.DefaultMetaDescriptorServiceImpl: unmarshall( final InputStream is ) unmarshaller = has value
[18/06/18 21:31:59:801 EDT] DEBUG parameters.DotsamlPropertiesService: Found idp.metadata.protocol : urn:oasis:names:tc:SAML:2.0:protocol
[18/06/18 21:31:59:801 EDT]  INFO meta.DefaultMetaDescriptorServiceImpl: Parsing the Id Provider, with the entityId: https://auth-test.uakron.edu/idp/shibboleth
[18/06/18 21:31:59:801 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:mace:shibboleth:1.0:profiles:AuthnRequest(https://auth-test.uakron.edu/idp/profile/Shibboleth/SSO)
[18/06/18 21:31:59:801 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST(https://auth-test.uakron.edu/idp/profile/SAML2/POST/SSO)
[18/06/18 21:31:59:801 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign(https://auth-test.uakron.edu/idp/profile/SAML2/POST-SimpleSign/SSO)
[18/06/18 21:31:59:801 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect(https://auth-test.uakron.edu/idp/profile/SAML2/Redirect/SSO)
[18/06/18 21:31:59:802 EDT] DEBUG parameters.DotsamlPropertiesService: Found idp.metadata.parser.classname : null
[18/06/18 21:31:59:802 EDT] DEBUG util.InstanceUtil: Creating an instance of: com.dotcms.plugin.saml.v3.meta.DefaultMetaDescriptorServiceImpl
[18/06/18 21:31:59:802 EDT]  INFO meta.DefaultMetaDescriptorServiceImpl: unmarshall( final InputStream is ) metadata = has value
[18/06/18 21:31:59:802 EDT]  INFO meta.DefaultMetaDescriptorServiceImpl: unmarshall( final InputStream is ) unmarshaller = has value
[18/06/18 21:31:59:808 EDT] DEBUG parameters.DotsamlPropertiesService: Found idp.metadata.protocol : urn:oasis:names:tc:SAML:2.0:protocol
[18/06/18 21:31:59:809 EDT]  INFO meta.DefaultMetaDescriptorServiceImpl: Parsing the Id Provider, with the entityId: https://auth-test.uakron.edu/idp/shibboleth
[18/06/18 21:31:59:809 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:mace:shibboleth:1.0:profiles:AuthnRequest(https://auth-test.uakron.edu/idp/profile/Shibboleth/SSO)
[18/06/18 21:31:59:809 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST(https://auth-test.uakron.edu/idp/profile/SAML2/POST/SSO)
[18/06/18 21:31:59:809 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign(https://auth-test.uakron.edu/idp/profile/SAML2/POST-SimpleSign/SSO)
[18/06/18 21:31:59:809 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect(https://auth-test.uakron.edu/idp/profile/SAML2/Redirect/SSO)
[18/06/18 21:31:59:810 EDT] DEBUG util.SamlUtils: Validating the signatures: []
[18/06/18 21:31:59:810 EDT] DEBUG parameters.DotsamlPropertiesService: Found idp.metadata.parser.classname : null
[18/06/18 21:31:59:810 EDT] DEBUG util.InstanceUtil: Creating an instance of: com.dotcms.plugin.saml.v3.meta.DefaultMetaDescriptorServiceImpl
[18/06/18 21:31:59:810 EDT]  INFO meta.DefaultMetaDescriptorServiceImpl: unmarshall( final InputStream is ) metadata = has value
[18/06/18 21:31:59:811 EDT]  INFO meta.DefaultMetaDescriptorServiceImpl: unmarshall( final InputStream is ) unmarshaller = has value
[18/06/18 21:31:59:813 EDT] DEBUG parameters.DotsamlPropertiesService: Found idp.metadata.protocol : urn:oasis:names:tc:SAML:2.0:protocol
[18/06/18 21:31:59:815 EDT]  INFO meta.DefaultMetaDescriptorServiceImpl: Parsing the Id Provider, with the entityId: https://auth-test.uakron.edu/idp/shibboleth
[18/06/18 21:31:59:815 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:mace:shibboleth:1.0:profiles:AuthnRequest(https://auth-test.uakron.edu/idp/profile/Shibboleth/SSO)
[18/06/18 21:31:59:815 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST(https://auth-test.uakron.edu/idp/profile/SAML2/POST/SSO)
[18/06/18 21:31:59:815 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign(https://auth-test.uakron.edu/idp/profile/SAML2/POST-SimpleSign/SSO)
[18/06/18 21:31:59:815 EDT] DEBUG meta.DefaultMetaDescriptorServiceImpl: Add SSO binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect(https://auth-test.uakron.edu/idp/profile/SAML2/Redirect/SSO)
[18/06/18 21:31:59:815 EDT] DEBUG util.SamlUtils: validateSignature : credentials : has value
[18/06/18 21:31:59:816 EDT] DEBUG util.SamlUtils: validateSignature : credentials : has value
[18/06/18 21:31:59:817 EDT] ERROR util.SamlUtils: Signature cannot be validated
org.opensaml.xmlsec.signature.support.SignatureException: Signature cannot be validated
	at com.dotcms.plugin.saml.v3.util.SamlUtils.validateSignature(SamlUtils.java:552) ~[SamlUtils.class:?]
	at com.dotcms.plugin.saml.v3.util.SamlUtils.verifyResponseSignature(SamlUtils.java:647) [SamlUtils.class:?]
	at com.dotcms.plugin.saml.v3.handler.HttpPostAssertionResolverHandlerImpl.resolveAssertion(HttpPostAssertionResolverHandlerImpl.java:96) [HttpPostAssertionResolverHandlerImpl.class:?]
	at com.dotcms.plugin.saml.v3.service.OpenSamlAuthenticationServiceImpl.resolveAssertion(OpenSamlAuthenticationServiceImpl.java:587) [OpenSamlAuthenticationServiceImpl.class:?]
	at com.dotcms.plugin.saml.v3.rest.DotSamlRestService.login(DotSamlRestService.java:87) [DotSamlRestService.class:?]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_171]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_171]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_171]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_171]
	at com.dotcms.repackage.org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$VoidOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:143) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) [dot.jersey-common-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) [dot.jersey-common-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.internal.Errors.process(Errors.java:315) [dot.jersey-common-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.internal.Errors.process(Errors.java:297) [dot.jersey-common-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.internal.Errors.process(Errors.java:267) [dot.jersey-common-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317) [dot.jersey-common-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.servlet.WebComponent.serviceImpl(WebComponent.java:471) [dot.jersey-container-servlet-core-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:425) [dot.jersey-container-servlet-core-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:383) [dot.jersey-container-servlet-core-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:336) [dot.jersey-container-servlet-core-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:223) [dot.jersey-container-servlet-core-2.22.1_1.jar:?]
	at com.dotcms.rest.servlet.ReloadableServletContainer.service(ReloadableServletContainer.java:105) [dotcms_4.3.2_ae725e9.jar:?]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:291) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:8.0.18]
	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) [tomcat-websocket.jar:8.0.18]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:721) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:466) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:391) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:318) [catalina.jar:8.0.18]
	at com.dotcms.repackage.org.tuckey.web.filters.urlrewrite.NormalRewrittenUrl.doRewrite(NormalRewrittenUrl.java:213) [dot.urlrewritefilter-4.0.3_2.jar:4.0.3]
	at com.dotcms.repackage.org.tuckey.web.filters.urlrewrite.RuleChain.handleRewrite(RuleChain.java:171) [dot.urlrewritefilter-4.0.3_2.jar:4.0.3]
	at com.dotcms.repackage.org.tuckey.web.filters.urlrewrite.RuleChain.doRules(RuleChain.java:145) [dot.urlrewritefilter-4.0.3_2.jar:4.0.3]
	at com.dotcms.repackage.org.tuckey.web.filters.urlrewrite.UrlRewriter.processRequest(UrlRewriter.java:92) [dot.urlrewritefilter-4.0.3_2.jar:4.0.3]
	at com.dotcms.repackage.org.tuckey.web.filters.urlrewrite.UrlRewriteFilter.doFilter(UrlRewriteFilter.java:394) [dot.urlrewritefilter-4.0.3_2.jar:4.0.3]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:8.0.18]
	at com.dotmarketing.filters.TimeMachineFilter.doFilter(TimeMachineFilter.java:132) [dotcms_4.3.2_ae725e9.jar:?]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:8.0.18]
	at com.dotmarketing.filters.ThreadNameFilter.doFilter(ThreadNameFilter.java:90) [dotcms_4.3.2_ae725e9.jar:?]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:8.0.18]
	at com.dotmarketing.filters.CookiesFilter.doFilter(CookiesFilter.java:38) [dotcms_4.3.2_ae725e9.jar:?]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:8.0.18]
	at com.dotmarketing.filters.CharsetEncodingFilter.doFilter(CharsetEncodingFilter.java:108) [dotcms_4.3.2_ae725e9.jar:?]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:8.0.18]
	at com.dotcms.plugin.saml.v3.filter.SamlAccessFilter.doFilter(SamlAccessFilter.java:177) [SamlAccessFilter.class:?]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:8.0.18]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina.jar:8.0.18]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106) [catalina.jar:8.0.18]
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501) [catalina.jar:8.0.18]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:142) [catalina.jar:8.0.18]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) [catalina.jar:8.0.18]
	at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:610) [catalina.jar:8.0.18]
	at org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:673) [catalina.jar:8.0.18]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) [catalina.jar:8.0.18]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:516) [catalina.jar:8.0.18]
	at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1086) [tomcat-coyote.jar:8.0.18]
	at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:659) [tomcat-coyote.jar:8.0.18]
	at org.apache.coyote.http11.Http11NioProtocol$Http11ConnectionHandler.process(Http11NioProtocol.java:223) [tomcat-coyote.jar:8.0.18]
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1558) [tomcat-coyote.jar:8.0.18]
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1515) [tomcat-coyote.jar:8.0.18]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_171]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_171]
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-util.jar:8.0.18]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_171]
[18/06/18 21:31:59:817 EDT] ERROR rest.DotSamlRestService: Signature cannot be validated
com.dotcms.plugin.saml.v3.exception.DotSamlException: Signature cannot be validated
	at com.dotcms.plugin.saml.v3.util.SamlUtils.verifyResponseSignature(SamlUtils.java:662) ~[SamlUtils.class:?]
	at com.dotcms.plugin.saml.v3.handler.HttpPostAssertionResolverHandlerImpl.resolveAssertion(HttpPostAssertionResolverHandlerImpl.java:96) ~[HttpPostAssertionResolverHandlerImpl.class:?]
	at com.dotcms.plugin.saml.v3.service.OpenSamlAuthenticationServiceImpl.resolveAssertion(OpenSamlAuthenticationServiceImpl.java:587) ~[OpenSamlAuthenticationServiceImpl.class:?]
	at com.dotcms.plugin.saml.v3.rest.DotSamlRestService.login(DotSamlRestService.java:87) [DotSamlRestService.class:?]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_171]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_171]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_171]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_171]
	at com.dotcms.repackage.org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$VoidOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:143) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) [dot.jersey-common-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) [dot.jersey-common-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.internal.Errors.process(Errors.java:315) [dot.jersey-common-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.internal.Errors.process(Errors.java:297) [dot.jersey-common-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.internal.Errors.process(Errors.java:267) [dot.jersey-common-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317) [dot.jersey-common-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154) [dot.jersey-server-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.servlet.WebComponent.serviceImpl(WebComponent.java:471) [dot.jersey-container-servlet-core-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:425) [dot.jersey-container-servlet-core-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:383) [dot.jersey-container-servlet-core-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:336) [dot.jersey-container-servlet-core-2.22.1_1.jar:?]
	at com.dotcms.repackage.org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:223) [dot.jersey-container-servlet-core-2.22.1_1.jar:?]
	at com.dotcms.rest.servlet.ReloadableServletContainer.service(ReloadableServletContainer.java:105) [dotcms_4.3.2_ae725e9.jar:?]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:291) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:8.0.18]
	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) [tomcat-websocket.jar:8.0.18]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:721) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:466) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:391) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:318) [catalina.jar:8.0.18]
	at com.dotcms.repackage.org.tuckey.web.filters.urlrewrite.NormalRewrittenUrl.doRewrite(NormalRewrittenUrl.java:213) [dot.urlrewritefilter-4.0.3_2.jar:4.0.3]
	at com.dotcms.repackage.org.tuckey.web.filters.urlrewrite.RuleChain.handleRewrite(RuleChain.java:171) [dot.urlrewritefilter-4.0.3_2.jar:4.0.3]
	at com.dotcms.repackage.org.tuckey.web.filters.urlrewrite.RuleChain.doRules(RuleChain.java:145) [dot.urlrewritefilter-4.0.3_2.jar:4.0.3]
	at com.dotcms.repackage.org.tuckey.web.filters.urlrewrite.UrlRewriter.processRequest(UrlRewriter.java:92) [dot.urlrewritefilter-4.0.3_2.jar:4.0.3]
	at com.dotcms.repackage.org.tuckey.web.filters.urlrewrite.UrlRewriteFilter.doFilter(UrlRewriteFilter.java:394) [dot.urlrewritefilter-4.0.3_2.jar:4.0.3]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:8.0.18]
	at com.dotmarketing.filters.TimeMachineFilter.doFilter(TimeMachineFilter.java:132) [dotcms_4.3.2_ae725e9.jar:?]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:8.0.18]
	at com.dotmarketing.filters.ThreadNameFilter.doFilter(ThreadNameFilter.java:90) [dotcms_4.3.2_ae725e9.jar:?]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:8.0.18]
	at com.dotmarketing.filters.CookiesFilter.doFilter(CookiesFilter.java:38) [dotcms_4.3.2_ae725e9.jar:?]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:8.0.18]
	at com.dotmarketing.filters.CharsetEncodingFilter.doFilter(CharsetEncodingFilter.java:108) [dotcms_4.3.2_ae725e9.jar:?]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:8.0.18]
	at com.dotcms.plugin.saml.v3.filter.SamlAccessFilter.doFilter(SamlAccessFilter.java:177) [SamlAccessFilter.class:?]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) [catalina.jar:8.0.18]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:8.0.18]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina.jar:8.0.18]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106) [catalina.jar:8.0.18]
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501) [catalina.jar:8.0.18]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:142) [catalina.jar:8.0.18]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) [catalina.jar:8.0.18]
	at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:610) [catalina.jar:8.0.18]
	at org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:673) [catalina.jar:8.0.18]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) [catalina.jar:8.0.18]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:516) [catalina.jar:8.0.18]
	at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1086) [tomcat-coyote.jar:8.0.18]
	at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:659) [tomcat-coyote.jar:8.0.18]
	at org.apache.coyote.http11.Http11NioProtocol$Http11ConnectionHandler.process(Http11NioProtocol.java:223) [tomcat-coyote.jar:8.0.18]
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1558) [tomcat-coyote.jar:8.0.18]
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1515) [tomcat-coyote.jar:8.0.18]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_171]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_171]
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-util.jar:8.0.18]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_171]
Caused by: org.opensaml.xmlsec.signature.support.SignatureException: Signature cannot be validated
	at com.dotcms.plugin.saml.v3.util.SamlUtils.validateSignature(SamlUtils.java:552) ~[SamlUtils.class:?]
	at com.dotcms.plugin.saml.v3.util.SamlUtils.verifyResponseSignature(SamlUtils.java:647) ~[SamlUtils.class:?]
	... 79 more

[thstave]

@gabbydotCMS Looking closer at the "use=signing" option. While I can't explain why previous versions allowed idp metadata not to contain the "use=signing". I believe this code is functioning as it was intended. If you prefer that we do not check that option, we can remove it from the code so it will never check the “use=signing” option. I have tested this and it works. Please just let me know.

[gabbydotCMS]

@thstave .. don't worry about making any further modifications.

Can you please comment here with the line(s) of code where you do this validation?

We'll take it from here and check why the behavior changed.

[thstave]

@gabbydotCMS .. Sure thing. It is getCredentialSigningList method in DefaultMetaDescriptorServiceImpl.

https://github.com/dotCMS/plugin-com.dotcms.dotsaml/blob/ethode-sp-endpoint-acs-rework/src/com/dotcms/plugin/saml/v3/meta/DefaultMetaDescriptorServiceImpl.java#L375