Qlik NPrinting SAML does not Authenticate with Shibboleth

When using Qlik NPrinting SAML with the Identity Provider Shibboleth, the user does not authenticate and is brought back to the NPrinting WebConsole login screen.
No error messages are seen on the WebConsole and the user is unable to login using SAML.

When enabling DEBUG logging per the help site: https://help.qlik.com/en-US/nprinting/November2018/Content/NPrinting/Troubleshooting/Troubleshooting-logs.htm
The following error will be seen:
 

18.39.6.0	Qlik.NPrinting.Repo.Service.AuthenticationService	INFO	QLIK-SERVER		0	0	0	0	0	0	0	0	Signature verification failed

 

Environment

Qlik NPrinting April 2018 and higher

The issue is due to how Qlik NPrinting is reading the Certificate.

IdP (e.g. Shibboleth) uses the second certificate to generate the SAML response signature. So if NPrinting uses the first certificate to validate the response signature, then the validation will fail.

The point is that NPrinting will take the first certificate with the "signing" attribute and use it to validate the SAML response signature it receives from the IdP, so, if this is not the certificate used for signing, the validation will fail.

In order to resolve the issue the second, unused Certificate must be manually removed from the IdP Metadata.
Once this is done it can be re-imported into the WebConsole and then the user will authenticate successfully.