title: Single Sign On SAML service failing to decrypt
body: <p>I'm implementing the service provider side of a Single Sign On solution. We are using PHP and the samlphp library provided by Onelogin. Everything is going pretty well. The user can attempt to access our service and is redirected to the IDP login. Once they login there they are redirected back to our site. </p>
  
  <p>This is where the problem occurs. Once back at our site we get an error...</p>
  
  <pre><code>&lt;Entry reference="REF_56dea40aa6419" TimeStamp="2016/03/08 12:06:02" Category="Exception" Type="Error"&gt;&lt;![CDATA[
  
  Description         Failure decrypting Data
  File  Library/SSO/OneLogin/extlib/xmlseclibs/xmlseclibs.php
  Line                357
  Class               Exception
  Stack               
  
  UI                  Business console
  User                -
  Code                0
  When                2016/03/08 12:06:02
  URL called          https://stage.icky-yuk.co.za/?acs
  Referred by         https://signon.blarg.co.za/adfs/ls/?SAMLRequest=hVNdrxIxEH038T%2BQfWc%2FgYsNYBD8IEEggD74YsZ2gCbddu10vVx%2Fvd2l5KJR7MsmM3NOzzmdHRGUqmLT2p30Fr%2FXSO7li44%2F51JpYm13HNVWMwMkiWkokZjjbDf9uGR5nLLKGme4UdGfuPswIELrpNEBt5iPo%2FXq7XL9frH6iv2ByDjvwzDvYZr3Hl7lw%2F6gKHp9gCLvpUWRP4iC5wH7GS15pnHkiX0pEBLVuNDkQDvfSbNBNy266XCfpSwdsDT7EtBz71lqcC3DybmKWJKQPGqjY6NEWbsaVMxN%2FBMSEAdKFCUBugne30gtpD7ed%2FztMkTsw36%2F6W7Wu31gmV6jmBlNdYl2h%2FaH5Phpu7wR5OCIsbHyKDU9kcOSgqbXwCmaXKhGTfCstW4n%2F4eW6ECAg7g6VaPkFntDV7GV97KYb4yS%2FOnSaM47Y0tw%2F%2FacxVlbkaJ7aEcZliDVVAiLRNEz0VQp8zizCA7HkbM1Rp3kdwFhM1G0e%2Bpjcnh2nZkpK7CSmnfDM3B3TeE5idv5mfI7t8XD5O5acsabOV%2Fe%2BM%2BjsaJ5ZOT%2B8r0FTZWxLkT1V%2FKgO7kj3M9c%2B7f%2F3eQX&amp;RelayState=https%3A%2F%2Fstage.icky-yuk.co.za%2F
  ]]&gt;&lt;/Entry&gt;
  </code></pre>
  
  <p>The metadata we are using with the SAML toolkit follows. It is in array form but I've spit it out json encoded so it is easier to read.</p>
  
  <pre><code>{
      "sp": {
          "entityId": "https:\/\/stage.icky-yuk.co.za\/metadata.php",
          "assertionConsumerService": {
              "url": "https:\/\/stage.icky-yuk.co.za\/?acs"
          },
          "singleLogoutService": {
              "url": "https:\/\/stage.icky-yuk.co.za\/?slo"
          },
          "NameIDFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
      },
      "idp": {
          "entityId": "http:\/\/signon.blarg.co.za\/adfs\/services\/trust",
          "singleSignOnService": {
              "url": "https:\/\/signon.blarg.co.za\/adfs\/ls\/",
              "binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
          },
          "singleLogoutService": {
              "url": "https:\/\/signon.blarg.co.za\/adfs\/ls\/",
              "binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
          },
          "x509cert": "MIIC6DCCAdCgAwIBAgIQWs7JU0DcbYBHCIni\/zAt\/jANBgkqhkiG9w0BAQsFADAwMS4wLAYDVQQDEyVBREZTIFNpZ25pbmcgLSBzaWdub24ub2xkbXV0dWFsLmNvLnphMB4XDTE1MDkyMzEzMTIzNloXDTE2MDkyMjEzMTIzNlowMDEuMCwGA1UEAxMlQURGUyBTaWduaW5nIC0gc2lnbm9uLm9sZG11dHVhbC5jby56YTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALlEeD4FX2CxAjacT+EJKbOFcAy604yvSPjy2NjKhjqGBeiJ4NLP4YKU28cEVa11IjqN18GE7bsk8wmA6yXEcAXgJs869fj1ZIXXil06DMSB4eUD0CaERpUSt7o6JR15kdmOEHq9tQp\/rAYoux3rSKBjmdZQlYeUTe13jfabrov3ftvWX6lTOUpZuJ2t61yCyxNNMN9pp0RlfYP8M03kq2boAoUxbYSxf\/Kpli0HrkRxtBaBiwy9TyVNjyY39ItHgAr\/gUA4vnAZj0kmSZwAc7gS6IXVbqo0A50yARzz\/6yrvMhkiFaJxFhwqck2hvoBWKwVBSSjozmDYw++gNUstj0CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEArSA6CrhdDvJXX120n0RJesumZAGHWBdb9NpE8p6hBq5gE0BcJm8lp\/PvgAyY+ZkZVpQEXv05q4po4FkkV2NcsyLHWzZ3S\/7OrleblqUIGm83a9o9mko6RuPrxdVpiwnatDAdV8gzebcr2OvedXGvkNJryblxkW7Gepoh8iPo9pFQ78NMoTGia+eLb+PtkuSV5yqtSSi9ggk8mdO+L9rZxrc9Uvkod+FLbtFg0DClsN5b3qvzd00UDmmbQfvSVGB40UGC5KqmJGSXrXSk6jUokm+h2VOUNSDyArMuiRtyFNrfY8GrWCc5Kz\/3ACuzEEhhTwD+67+qJH5jDD7KTDPQ\/w=="
      }
  }
  </code></pre>
  
  <p>I've double-checked the x509 certification and it is good. I admit I'm not a SAML or Single Sign On expert by any stretch of the imagination. I'm obviously overlooking something here. Is there some other component to the encryption beyond the cert? I'm not sure where to look anymore.</p>