<div dir="ltr">Hello,<br><div class="gmail_quote"><div dir="ltr"><div><div><div><div><div><div><br></div>I have turned ON signing responses and assertions for my SP. I am able to see that the IdP is signing both in the assertion. While validating the signature at SP, I am trying to use the public key sent in the XML signature. I am obtaining the public key from the XML DOM, but I have to pre-pend '-----BEGIN CERTIFICATE-----' and append '-----END CERTIFICATE-----' to generate an java.security.cert.X509Certificate object. Upon further investigation, I see that these lines are being removed while generating the idp-metadata.xml(at MetadataGeneratorParameters.getCertificateContents()).<br><br></div>1. Is it a good practice to use the public key from the SAML assertion?<br></div>2. If yes, are there any existing utility methods - that I'm unaware of - to create or validate the signature without having to append and pre-pend the markers.<br></div>3. Why are the markers stripped off from the x509certificate in idp-metadata.xml.<br><br></div><div>For the record, I have followed <br><br><a href="https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaDSIG" target="_blank">https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaDSIG</a> <br><br>page, which was helpful, but the method call 'getVerificationCredential()' was not clear, which is what I was trying to implement.<br></div><div><br></div>Many thanks for your help.<br><br></div><div>Regards,<br></div>Sundeep<br></div>
</div></div>