We are migrating from ADFS2 to ADFS3. I have setup ADFS3 successfully and migrated the relying parties from ADFS2 to 3. When testing all the WS-Federation sites work fine, also one to Jive which uses SAML is OK. I am having problems with Shibboleth. The error logs are reporting
The Federation Service encountered an error while processing the SAML authentication request.
Additional Data
Exception details:
Microsoft.IdentityModel.Protocols.XmlSignature.SignatureVerificationFailedException: MSIS0038: SAML Message has wrong signature. Issuer: 'https://URL/shibboleth'.
at Microsoft.IdentityServer.Protocols.Saml.Contract.SamlContractUtility.CreateSamlMessage(MSISSamlBindingMessage message)
at Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolManager.Issue(HttpSamlRequestMessage httpSamlRequestMessage, SecurityTokenElement onBehalfOf, String sessionState, String relayState, String& newSamlSession, String& samlpAuthenticationProvider, Boolean isUrlTranslationNeeded, WrappedHttpListenerContext context, Boolean isKmsiRequested)
On looking thru the forums it looks like previous windows updates have caused this. However I have not been able to find the updates in question on the server. This is using a fresh install of Server 2012 R2 and fully updated by windows Update. This all works with ADFS2 just not with ADFS3.
Does anybody have any ideas or pointers on how to solve this?