Identity Platform - SAML - Signing requests

[vitolo]

Hello,

i've enabled Signed Request option on a saml authentication managed by identity platform. Docs about this feature is here: https://cloud.google.com/identity-platform/docs/web/saml#signing_requests 

After enabling it, the payload of authentication request correctly contains two more params: SigAlg: http://www.w3.org/2000/09/xmldsig#rsa-sha1
and
Signature: HzlyeADFBfptu44...

During the activation process, as described by docs, google returns an X509Certificate.

"spCertificates": [
      {
        "x509Certificate": "-----BEGIN CERTIFICATE-----\nMIIDMDCCAhigAw.....-----END CERTIFICATE-----\n",
        "expiresAt": "2028-08-29T17:23:48.626Z"
      }
]

The problem is that Signature verification with the X509Certificate always fails!

Do you have any suggestion?

thanks, vittorio