InCommon metadata support

["Kathy E. Wright" <>]

We are trying to update our InCommon SPs to use the new metadata aggregate.

According to the example found in the documentation located here:

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataProvider

.. this configuration in our /etc/shibboleth/shibboleth2.xml file appears to suffice for the new aggregate:

<MetadataProvider type="Chaining">
  <MetadataProvider type="XML" path="partners.xml"/>
  <MetadataProvider type="XML" url=""https://federation.org/metadata.xml" backingFilePath="fedmetadata.xml"/>
</MetadataProvider>

However, will this config work satisfactorily without reference to the cert? 

<MetadataFilter type="Signature" certificate="incommon/inc-md-cert.pem"/>

When we've included this reference, our shibd_warn.log has the following error.

WARN OpenSAML.MetadataFilter.Signature : filtering out group at root of instance after failed signature check: Unable to verify signature with supplied key(s).

Thank you,

Kathy Wright

Clemson University