docs: protected SignatureSigningConfiguration getSignatureSigningConfiguration(final RoleDescriptor roleDescriptor,
                                                                               final SamlRegisteredService service) throws Exception {
          val config = DefaultSecurityConfigurationBootstrap.buildDefaultSignatureSigningConfiguration();
          val samlIdp = casProperties.getAuthn().getSamlIdp();
          val algs = samlIdp.getAlgs();
  
          val overrideSignatureReferenceDigestMethods = algs.getOverrideSignatureReferenceDigestMethods();
          val overrideSignatureAlgorithms = algs.getOverrideSignatureAlgorithms();
          val overrideBlackListedSignatureAlgorithms = algs.getOverrideBlackListedSignatureSigningAlgorithms();
          val overrideWhiteListedAlgorithms = algs.getOverrideWhiteListedSignatureSigningAlgorithms();
  
          if (overrideBlackListedSignatureAlgorithms != null && !overrideBlackListedSignatureAlgorithms.isEmpty()) {
              config.setBlacklistedAlgorithms(overrideBlackListedSignatureAlgorithms);
          }
  
          if (overrideSignatureAlgorithms != null && !overrideSignatureAlgorithms.isEmpty()) {
              config.setSignatureAlgorithms(overrideSignatureAlgorithms);
          }
  
          if (overrideSignatureReferenceDigestMethods != null && !overrideSignatureReferenceDigestMethods.isEmpty()) {
              config.setSignatureReferenceDigestMethods(overrideSignatureReferenceDigestMethods);
          }
  
          if (overrideWhiteListedAlgorithms != null && !overrideWhiteListedAlgorithms.isEmpty()) {
              config.setWhitelistedAlgorithms(overrideWhiteListedAlgorithms);
          }
  
          if (StringUtils.isNotBlank(algs.getOverrideSignatureCanonicalizationAlgorithm())) {
              config.setSignatureCanonicalizationAlgorithm(algs.getOverrideSignatureCanonicalizationAlgorithm());
          }
          LOGGER.trace("Signature signing blacklisted algorithms: [{}]", config.getBlacklistedAlgorithms());
          LOGGER.trace("Signature signing signature algorithms: [{}]", config.getSignatureAlgorithms());
          LOGGER.trace("Signature signing signature canonicalization algorithm: [{}]", config.getSignatureCanonicalizationAlgorithm());
          LOGGER.trace("Signature signing whitelisted algorithms: [{}]", config.getWhitelistedAlgorithms());
          LOGGER.trace("Signature signing reference digest methods: [{}]", config.getSignatureReferenceDigestMethods());
  
          val privateKey = getSigningPrivateKey();
  
          val kekCredentialResolver = new MetadataCredentialResolver();
          val roleDescriptorResolver = SamlIdPUtils.getRoleDescriptorResolver(casSamlIdPMetadataResolver, samlIdp.getMetadata().isRequireValidMetadata());
          kekCredentialResolver.setRoleDescriptorResolver(roleDescriptorResolver);
          kekCredentialResolver.setKeyInfoCredentialResolver(DefaultSecurityConfigurationBootstrap.buildBasicInlineKeyInfoCredentialResolver());
          kekCredentialResolver.initialize();
          
          val criteriaSet = new CriteriaSet();
          criteriaSet.add(new SignatureSigningConfigurationCriterion(config));
          criteriaSet.add(new UsageCriterion(UsageType.SIGNING));
          criteriaSet.add(new EntityIdCriterion(samlIdp.getEntityId()));
          criteriaSet.add(new EntityRoleCriterion(IDPSSODescriptor.DEFAULT_ELEMENT_NAME));
  
          val credentials = Sets.<Credential>newLinkedHashSet(kekCredentialResolver.resolve(criteriaSet));
          val creds = new ArrayList<Credential>();
  
          credentials.forEach(c -> {
              val cred = getResolvedSigningCredential(c, privateKey, service);
              if (cred != null) {
                  if (doesCredentialFingerprintMatch(cred, service)) {
                      creds.add(cred);
                  }
              }
          });
  
          if (creds.isEmpty()) {
              LOGGER.error("Unable to locate any signing credentials for service [{}]", service.getName());
              throw new IllegalArgumentException("Unable to locate signing credentials");
          }
  
          config.setSigningCredentials(creds);
          LOGGER.trace("Signature signing credentials configured with [{}] credentials", creds.size());
          return config;
      }