Validate SAML >>1.0<< assertion?

[guycrets]

Hi all,

We need to validate SAML 1.0 assertion as part of WS-Sec request. Apigee's ValidateSAMLAssertion policy only supports SAML 2.0. Any suggestions how we could tackle this? Maybe someone who can share a great piece of Java(script) code or other?

Looking forward to your feedback, Guy Crets

[dchiesa1]

If I were doing his I would do it in Java. Validating an assertion means, I suppose, obtaining an X.509 certificate, extracting a public key from that, and then verifying a signature on the assertion. a bunch of crypto. It's better doing that in Java.

This callout does not do what you want, but it might be a good starting point.

https://github.com/DinoChiesa/Apigee-Java-WsSec-Signature-2

[dchiesa1]

Guycrets, Did you solve this problem?