protected SignatureSigningConfiguration getSignatureSigningConfiguration(final SamlRegisteredService service) throws Throwable {
        val config = configureSignatureSigningSecurityConfiguration(service);

        val samlIdp = casProperties.getAuthn().getSamlIdp();
        val privateKey = getSigningPrivateKey(service);

        val mdCredentialResolver = new SamlIdPMetadataCredentialResolver();
        val roleDescriptorResolver = SamlIdPUtils.getRoleDescriptorResolver(
            samlIdPMetadataResolver,
            samlIdp.getMetadata().getCore().isRequireValidMetadata());
        mdCredentialResolver.setRoleDescriptorResolver(roleDescriptorResolver);
        mdCredentialResolver.setKeyInfoCredentialResolver(
            DefaultSecurityConfigurationBootstrap.buildBasicInlineKeyInfoCredentialResolver());
        mdCredentialResolver.initialize();

        val criteriaSet = new CriteriaSet();
        criteriaSet.add(new SignatureSigningConfigurationCriterion(config));
        criteriaSet.add(new UsageCriterion(UsageType.SIGNING));

        val entityIdCriteriaSet = new CriteriaSet(
            new EvaluableEntityRoleEntityDescriptorCriterion(IDPSSODescriptor.DEFAULT_ELEMENT_NAME),
            new SamlIdPSamlRegisteredServiceCriterion(service));
        LOGGER.trace("Resolving entity id from SAML2 IdP metadata for signature signing configuration is [{}]", service.getName());
        val entityId = Objects.requireNonNull(samlIdPMetadataResolver.resolveSingle(entityIdCriteriaSet)).getEntityID();
        LOGGER.trace("Resolved entity id from SAML2 IdP metadata is [{}]", entityId);
        criteriaSet.add(new EntityIdCriterion(entityId));
        criteriaSet.add(new EntityRoleCriterion(IDPSSODescriptor.DEFAULT_ELEMENT_NAME));
        criteriaSet.add(new SamlIdPSamlRegisteredServiceCriterion(service));

        LOGGER.trace("Resolved signing credentials based on criteria [{}]", criteriaSet);
        val credentials = Sets.newLinkedHashSet(mdCredentialResolver.resolve(criteriaSet));
        LOGGER.trace("Resolved [{}] signing credentials", credentials.size());

        val finalCredentials = new ArrayList<Credential>();
        credentials.stream()
            .map(creds -> getResolvedSigningCredential(creds, privateKey, service))
            .filter(Objects::nonNull)
            .filter(creds -> doesCredentialFingerprintMatch(creds, service))
            .forEach(finalCredentials::add);

        if (finalCredentials.isEmpty()) {
            LOGGER.error("Unable to locate any signing credentials for service [{}]", service.getName());
            throw new IllegalArgumentException("Unable to locate signing credentials");
        }

        config.setSigningCredentials(finalCredentials);
        LOGGER.trace("Signature signing credentials configured with [{}] credentials", finalCredentials.size());
        return config;
    }
Gets signature signing configuration.
The resolved used is {@link SamlIdPMetadataCredentialResolver} that
allows the entire criteria set to be passed to the role descriptor resolver.
This behavior allows the passing of {@link SamlIdPSamlRegisteredServiceCriterion}
so signing configuration, etc can be fetched for a specific service as an override,
if on is in fact defined for the service.

@param service the service
@return the signature signing configuration
@throws Throwable the throwable
support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/builders/enc/DefaultSamlIdPObjectSigner.java