Which one of these tests actually verifies the signature I'm not sure, nor why there are these two tests, I don't suppose you have any idea?

The former test verifies that the signature is a valid signature of the dataset by the equivalent private key, so this is the attribution part of the verification if you like. However, since what has actually been signed isn't normally the full SAML request but rather a digest of it you then need the latter test to confirm that the digest is in fact valid for the full SAML request too.

If the signature test fails, then either the digest has been monkeyed with or the wrong (impostor?) key has been used. If the signature test passes but the digest fails then someone has amended the XML payload after the signature has been made (or copied a valid signature from some other frame, etc.). Only if both tests pass can you be sure that the entire SAML message is valid.

Don't forget to check the timestamps too if you are rolling it yourself.

In reply to Re^7: Validating XML Signatures / SSL Certificate question (using Net::SAML) by hippo
in thread Validating XML Signatures / SSL Certificate question (using Net::SAML) by MattP

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.