SAML Signature Verification and Code Compatibility

Google Cloud Apigee
,
1

I have a couple of questions and would appreciate your inputs

  1. In the context of a SOAP proxy(WS-Security), Can we use validate SAML assertion policy to verify an X.509 signature, or do we need to rely on a Java callout with JAR files for this like discussed below. GitHub - DinoChiesa/Apigee-Java-WsSec-Signature-2: 2nd implementation of a Java callout that performs WS-Security Signing and Validating
  2. Is the code shared in Git applicable for both the hybrid and on-premise versions?

Thanks in advance for your help! @dchiesa1

2

There is a built-in ValidateSAMLAssertion policy that is most often used with SAML soap messages.

It should work.
You do not need to rely on the Java callout for signature validation. The Java callout is a little more flexible , I’d say.