I'm trying to understand the SAML protocol 2.0 (signed) exchange.

Here is what I understood so far:

  • IDP has its own public (PB1) and private (PV1) pair
  • SP has its own public (PB2) and private (PV2) pair

Now when an IDP has to sign a data, it does so by using it Private key PV1. Then SP can verify it using the public key PB1 accessible to SP via metadata of IDP / KeyInfo.

Likewise, if SP has to sign data, it does so using its own private key PV2 then IDP can verify the sign data using public key PB2 accessible to IDP via metadata of SP/ KeyInfo.

Is my understanding correct?

1 Answer 1


This is correct. That is one way that signature varification can be made and it is as far as I know the most common one.

It is also possible to for the entity signing to attach the public certificate to be used for verification, in the signed XML. This then assumes that the certificate is validated by som other mean like verifying that it is signed by a trusted CA.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .