public boolean validateSignature ( final Pair < Assertion , WsFederationConfiguration > resultPair ) { if ( resultPair == null ) { LOGGER . warn ( "No assertion or its configuration was provided to validate signatures" ) ; return false ; } val configuration = resultPair . getValue ( ) ; val assertion = resultPair . getKey ( ) ; if ( assertion == null || configuration == null ) { LOGGER . warn ( "No signature or configuration was provided to validate signatures" ) ; return false ; } val signature = assertion . getSignature ( ) ; if ( signature == null ) { LOGGER . warn ( "No signature is attached to the assertion to validate" ) ; return false ; } try { LOGGER . debug ( "Validating the signature..." ) ; val validator = new SAMLSignatureProfileValidator ( ) ; validator . validate ( signature ) ; val criteriaSet = new CriteriaSet ( ) ; criteriaSet . add ( new UsageCriterion ( UsageType . SIGNING ) ) ; criteriaSet . add ( new EntityRoleCriterion ( IDPSSODescriptor . DEFAULT_ELEMENT_NAME ) ) ; criteriaSet . add ( new ProtocolCriterion ( SAMLConstants . SAML20P_NS ) ) ; criteriaSet . add ( new EntityIdCriterion ( configuration . getIdentityProviderIdentifier ( ) ) ) ; try { val engine = buildSignatureTrustEngine ( configuration ) ; LOGGER . debug ( "Validating signature via trust engine for [{}]" , configuration . getIdentityProviderIdentifier ( ) ) ; return engine . validate ( signature , criteriaSet ) ; } catch ( final SecurityException e ) { LOGGER . warn ( e . getMessage ( ) , e ) ; } } catch ( final SignatureException e ) { LOGGER . error ( "Failed to validate assertion signature" , e ) ; } SamlUtils . logSamlObject ( this . configBean , assertion ) ; LOGGER . error ( "Signature doesn't match any signing credential and cannot be validated." ) ; return false ; }
validateSignature checks to see if the signature on an assertion is valid .