metadata_persister is never called about saml_idp HOT 5 CLOSED

I'm betting that error is why it doesn't hit persister ever. It validates the signature on the metadata document before persisting. That seems like a red-herring though and not like it'd be your actual issue. The persister is more about a between-request memoization and shouldn't actually affect things like this.

I don't see "Issuer cannot be verified" anywhere in the code, so it sounds like the client is disagreeing with the IDP in terms of credentials or signing.

from saml_idp.

@jphenow thank you! Ok so I should look into the certificate exchange and signing. When using a public cert is there a way to null out the secret_key? config.secret_key = nil caused an error when i tried it. Reason I ask is I am trying to get down to bare minimum cert requirements and then build up from there.

from saml_idp.

Interesting - we should possibly allow that to be nil'd, but you could try an empty string

from saml_idp.

@jphenow I agree that this must be an issue on the SP side of things. Closing this issue and thank you for the feedback!

from saml_idp.

Anytime! Good luck :)

from saml_idp.