A question about how to verify the Assertion sent from IdP

[Yaowen Tu]

Hi,

I am trying to implement an SP using openSAML api. I know maybe this is not
a question specific to SAML, but people here should be able to answer it in
the perspective of SAML world.

When SP receive an Assertion from IdP. Usually the Assertion contains a
signature and a X509 Certificate. Then SP need to verify it, but I am
wondering which certificate SP should use to verify it?
1) The X509 Certificate in the metadata.xml that has been exchanged when
the SP and IdP launches.
2) The X509 Certificate in the Assertion itself.

I think we should use #2, is it? #1 should be used to verify the metadata
itself right? In reality, these two certificates should be the same right?

Can you also tell me what is the idp-metadata mainly used for? Is it used
for SP to know which URLs that SP should send to for different type of
authentication requests? Anything else?

Thanks,
Yaowen
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120720/c8ec8cc5/attachment.html