3518363 - Get error log "Signature trust establishment failed for metadata entry" because of incorrect format of IDP metadata.xml

After implementing SSO, application pods failed to startup with error logs like:

SEVERE: Exception sending context initialized event to listener instance of class [de.hybris.platform.spring.HybrisContextLoaderListener]
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.filterChains': Cannot resolve reference to bean 'org.springframework.security.web.DefaultSecurityFilterChain#3' while setting bean property 'sourceList' with key [3]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.web.DefaultSecurityFilterChain#3': Cannot resolve reference to bean 'samlMetadataFilter' while setting constructor argument with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'samlMetadataFilter' defined in ServletContext resource [/WEB-INF/security/spring-security-config.xml]: Cannot resolve reference to bean 'defaultRelyingPartyRegistrationResolverIdAware' while setting constructor argument; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'defaultRelyingPartyRegistrationResolverIdAware' defined in ServletContext resource [/WEB-INF/security/spring-security-config.xml]: Cannot resolve reference to bean 'defaultRelyingPartyRegistrationResolver' while setting constructor argument; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'defaultRelyingPartyRegistrationResolver' defined in ServletContext resource [/WEB-INF/security/spring-security-config.xml]: Cannot resolve reference to bean 'relyingPartyRegistrationRepository' while setting constructor argument; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'relyingPartyRegistrationRepository' defined in ServletContext resource [/WEB-INF/security/spring-security-config.xml]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository]: Factory method 'getRelyingPartyRegistrationRepository' threw exception; nested exception is de.hybris.platform.samlsinglesignon.exceptions.InvalidMetadataException: Error filtering metadata from metadata.xml
    at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:342)
    at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveValueIfNecessary(BeanDefinitionValueResolver.java:113)
    at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveManagedList(BeanDefinitionValueResolver.java:428)
    at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveValueIfNecessary(BeanDefinitionValueResolver.java:173)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.applyPropertyValues(AbstractAutowireCapableBeanFactory.java:1707)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1452)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:619)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:542)
    at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:336)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:334)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:209)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:936)
    at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:932)
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:591)
    at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:399)
    at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:278)
    at de.hybris.platform.spring.HybrisContextLoaderListener.doInitWebApplicationContext(HybrisContextLoaderListener.java:226)
    at de.hybris.platform.spring.HybrisContextLoaderListener.initWebApplicationContext(HybrisContextLoaderListener.java:199)
    at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:103)
    at de.hybris.platform.spring.HybrisContextLoaderListener.contextInitializedInternal(HybrisContextLoaderListener.java:96)
    at de.hybris.platform.spring.HybrisContextLoaderListener.contextInitialized(HybrisContextLoaderListener.java:91)
    at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4462)
    at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:4914)
    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:171)
    at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1332)
    at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1322)
    at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
    at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63)
    at java.base/java.lang.Thread.run(Thread.java:840)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.web.DefaultSecurityFilterChain#3': Cannot resolve reference to bean 'samlMetadataFilter' while setting constructor argument with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'samlMetadataFilter' defined in ServletContext resource [/WEB-INF/security/spring-security-config.xml]: Cannot resolve reference to bean 'defaultRelyingPartyRegistrationResolverIdAware' while setting constructor argument; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'defaultRelyingPartyRegistrationResolverIdAware' defined in ServletContext resource [/WEB-INF/security/spring-security-config.xml]: Cannot resolve reference to bean 'defaultRelyingPartyRegistrationResolver' while setting constructor argument; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'defaultRelyingPartyRegistrationResolver' defined in ServletContext resource [/WEB-INF/security/spring-security-config.xml]: Cannot resolve reference to bean 'relyingPartyRegistrationRepository' while setting constructor argument; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'relyingPartyRegistrationRepository' defined in ServletContext resource [/WEB-INF/security/spring-security-config.xml]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository]: Factory method 'getRelyingPartyRegistrationRepository' threw exception; nested exception is de.hybris.platform.samlsinglesignon.exceptions.InvalidMetadataException: Error filtering metadata from metadata.xml
    at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:342)
    at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveValueIfNecessary(BeanDefinitionValueResolver.java:113)
    at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveManagedList(BeanDefinitionValueResolver.java:428)
    at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveValueIfNecessary(BeanDefinitionValueResolver.java:173)
    at org.springframework.beans.factory.support.ConstructorResolver.resolveConstructorArguments(ConstructorResolver.java:681)
    at org.springframework.beans.factory.support.ConstructorResolver.autowireConstructor(ConstructorResolver.java:189)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.autowireConstructor(AbstractAutowireCapableBeanFactory.java:1372)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1222)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:582)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:542)
    at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:336)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:334)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:209)
    at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:330)
    ... 32 more

......

Caused by: de.hybris.platform.samlsinglesignon.exceptions.InvalidMetadataException: Error filtering metadata from metadata.xml
    at de.hybris.platform.samlsinglesignon.security.SamlObjectsFactory.getBuilderFromMetadataWithValidatedSignatureOfMetadata(SamlObjectsFactory.java:211)
    at de.hybris.platform.samlsinglesignon.security.SamlObjectsFactory.getRelyingPartyRegistration(SamlObjectsFactory.java:108)
    at de.hybris.platform.samlsinglesignon.security.SamlObjectsFactory.getRelyingPartyRegistrationRepository(SamlObjectsFactory.java:94)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.base/java.lang.reflect.Method.invoke(Method.java:568)
    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:154)
    ... 93 more
Caused by: org.opensaml.saml.metadata.resolver.filter.FilterException: Signature trust establishment failed for metadata entry
    at org.opensaml.saml.metadata.resolver.filter.impl.SignatureValidationFilter.verifySignature(SignatureValidationFilter.java:427)
    at org.opensaml.saml.metadata.resolver.filter.impl.SignatureValidationFilter.processEntityDescriptor(SignatureValidationFilter.java:268)
    at org.opensaml.saml.metadata.resolver.filter.impl.SignatureValidationFilter.filter(SignatureValidationFilter.java:236)
    at de.hybris.platform.samlsinglesignon.security.SamlObjectsFactory.getBuilderFromMetadataWithValidatedSignatureOfMetadata(SamlObjectsFactory.java:204)
    ... 100 more

SAP Commerce Cloud

Single Sign-On, metadata.txt , KBA , CEC-SCC-PLA-PL , Platform , Problem