We are using SAML Web Browser SSO Profile (SAML 2.0)
We have a SP using SAML2.0. All communication between IdP and SP is over HTTPs.
If AuthnResponse from IdP is sent over HTTPs, is it mandatory for the SP to validate the signature on both the encrypted assertions and the signature on the entire response? Is the IdP not required to do signature validation if the all the assertions are encrypted?