I'm trying to understand the SAML protocol 2.0 (signed) exchange.
Here is what I understood so far:
- IDP has its own public (
PB1) and private (
- SP has its own public (
PB2) and private (
Now when an IDP has to sign a data, it does so by using it Private key
Then SP can verify it using the public key
PB1 accessible to SP via metadata of IDP / KeyInfo.
Likewise, if SP has to sign data, it does so using its own private key
then IDP can verify the sign data using public key
PB2 accessible to IDP via metadata of SP/ KeyInfo.
Is my understanding correct?