@Override
    public List<Credential> getSigningCredentials() throws Exception {
        try (val is = metadataResource.getInputStream()) {
            val resolver = new InMemoryResourceMetadataResolver(is, openSamlConfigBean);
            resolver.setId(UUID.randomUUID().toString());
            resolver.initialize();
            val criteria = new CriteriaSet(new EntityIdCriterion(configuration.getIdentityProviderIdentifier()),
                new EvaluableEntityRoleEntityDescriptorCriterion(IDPSSODescriptor.DEFAULT_ELEMENT_NAME));
            LOGGER.debug("Locating entity descriptor in the metadata for [{}]", configuration.getIdentityProviderIdentifier());
            val entityDescriptor = resolver.resolveSingle(criteria);
            val roleDescriptors = entityDescriptor.getRoleDescriptors(IDPSSODescriptor.DEFAULT_ELEMENT_NAME);
            val signingDescriptors = roleDescriptors.getFirst().getKeyDescriptors()
                .stream()
                .filter(key -> key.getUse() == UsageType.SIGNING)
                .collect(Collectors.toList());
            Collections.reverse(signingDescriptors);

            return signingDescriptors
                .stream()
                .map(KeyDescriptor::getKeyInfo)
                .map(KeyInfo::getX509Datas)
                .flatMap(List::stream)
                .map(X509Data::getX509Certificates)
                .flatMap(List::stream)
                .map(Unchecked.function(cert -> {
                    LOGGER.debug("Parsing signing certificate [{}]", cert.getValue());
                    val decode = EncodingUtils.decodeBase64(cert.getValue());
                    try (val value = new ByteArrayInputStream(decode)) {
                        return WsFederationCertificateProvider.readCredential(value);
                    }
                }))
                .collect(Collectors.toList());
        }
    }
This is {@link WsFederationMetadataCertificateProvider}.
OpenSAML does not yet support parsing out the WSFED metadata.
So instead we rely on the presence of {@link IDPSSODescriptor} and
its signing x509 certificate in the metadata to locate the certificate.
@author Misagh Moayyed
@since 6.5.0
support/cas-server-support-wsfederation/src/main/java/org/apereo/cas/support/wsfederation/authentication/crypto/WsFederationMetadataCertificateProvider.java