根据Credential验证SAML断言 - opensaml 3

Question

I've validated the signature using SAMLSignatureProfileValidator but from my understanding when I validate a signature using this, it only makes sure the response hasn't been tampered with. Ie it checks the structure of the signature to make sure it is well formatted.

How do I validate the SAML Assertion using the publicKey of a certificate I have from the IdP or a credential? Do I have to manually locate the certificate node and compare the value...? I am using OpenSAML3 and there is no SignatureValidator so I can't pass in the pub key.

Answer 1

The Signature validator in OpenSAML V3 is no longer instantiated but instead a static method on SignatureValidator is used for validation. Use the SignatureValidator.validate method to validate the signature.