<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
On Aug 1, 2014, at 6:50 PM, Andrew A. DeVries <<a href="mailto:adevries@digitalexample.com">adevries@digitalexample.com</a>> wrote:<br>
<div><br class="Apple-interchange-newline">
<blockquote type="cite">
<div><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">Am
I correct in that the public key used to validate the signature is included in the returned assertion?<span class="Apple-converted-space"> </span></span></div>
</blockquote>
</div>
<div><br>
</div>
<div>Many IdP implementations do return it in the Response, but you should never trust it because its in the response. If you do, you are trusting random data being sent to you. You have to establish that trust out of band.</div>
<div><br>
</div>
Paul
<div><br>
<div apple-content-edited="true">Paul Hethmon<br>
Chief Software Architect<br>
<a href="mailto:paul.hethmon@clareitysecurity.com">paul.hethmon@clareitysecurity.com</a><br>
<br>
</div>
<br>
</div>
</body>
</html>