Small question regarding signature validation in OpenSAML

[Cantor, Scott]

On 1/31/14, 5:09 AM, "Gerald Preissler" <gerald.preissler at innoq.com> wrote:
>
>One little question regarding the validation of signatures. I'm
>currently using org.opensaml.xml.signature.SignatureValidator with a
>BasicX509Credential initialized with the correct public key to validate
>the signature I got from Response.getSignature. Does this validation
>already verify that the dsig:Signature/dsig:Reference contained in the
>XML representation of the OpenSAML Signature object correctly references
>the Response element contained in the OpenSAML Response object to which
>the Signature is attached?

No, absolutely not. The SignatureProfileValidator does reference
validation.

The security policy rules in the library illustrate how to do this sort of
thing.

-- Scott