XML signature validation

[Sandy]

Hello,

I have turned ON signing responses and assertions for my SP. I am able to
see that the IdP is signing both in the assertion. While validating the
signature at SP, I am trying to use the public key sent in the XML
signature. I am obtaining the public key from the XML DOM, but I have to
pre-pend '-----BEGIN CERTIFICATE-----' and append '-----END
CERTIFICATE-----' to generate an java.security.cert.X509Certificate object.
Upon further investigation, I see that these lines are being removed while
generating the idp-metadata.xml(at
MetadataGeneratorParameters.getCertificateContents()).

1. Is it a good practice to use the public key from the SAML assertion?
2. If yes, are there any existing utility methods - that I'm unaware of -
to create or validate the signature without having to append and pre-pend
the markers.
3. Why are the markers stripped off from the x509certificate in
idp-metadata.xml.

For the record, I have followed

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaDSIG

page, which was helpful, but the method call 'getVerificationCredential()'
was not clear, which is what I was trying to implement.

Thank you,
Sundeep

P.S.: My apologies for posting this question first in the users list. It
belongs to the dev list. My bad! As always, I appreciate your patience.
Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20141215/63ce2d83/attachment.html