Validate SAML Assertion against Credential - opensaml 3

3
votes

I've validated the signature using SAMLSignatureProfileValidator but from my understanding when I validate a signature using this, it only makes sure the response hasn't been tampered with. I.e. it checks the structure of the signature to make sure it is well formatted.

How do I validate the SAML Assertion using the publicKey of a certificate I have from the IdP or a credential? Do I have to manually locate the certificate node and compare the value...? I am using OpenSAML3 and there is no SignatureValidator so I can't pass in the pub key.

1
javavalidationsaml-2.0opensaml

1 Answers

2
votes

The Signature validator in OpenSAML V3 is no longer instantiated but instead a static method on SignatureValidator is used for validation. Use the SignatureValidator.validate method to validate the signature.