How to manually validate a SAMLResponse signature?
<p>Given the following SAML response, how can I manually validate that the signature is valid? I assume I should rely on the IDP's certificate supplied in metadata and not the one in the response itself (although they should be the same).</p>

<p>Is there some way to do this with openssl or xmlsec1 commands?</p>

<pre><code>&lt;samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="s2a79da8e2cd2eda272fd5d2d474858f1919430a96" Version="2.0" IssueInstant="2016-08-25T00:24:45Z" Destination="http://10.88.111.163:8080/zport/dmd"&gt;
  &lt;saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"&gt;https://idp.ssocircle.com&lt;/saml:Issuer&gt;
  &lt;samlp:Status xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"&gt;
&lt;samlp:StatusCode xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Value="urn:oasis:names:tc:SAML:2.0:status:Success"&gt;
&lt;/samlp:StatusCode&gt;
&lt;/samlp:Status&gt;
  &lt;saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="s22b55a88e8022a4d198715d5b3f21c3fbd699dac4" IssueInstant="2016-08-25T00:24:45Z" Version="2.0"&gt;
&lt;saml:Issuer&gt;https://idp.ssocircle.com&lt;/saml:Issuer&gt;&lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
&lt;ds:SignedInfo&gt;
&lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
&lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
&lt;ds:Reference URI="#s22b55a88e8022a4d198715d5b3f21c3fbd699dac4"&gt;
&lt;ds:Transforms&gt;
&lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/&gt;
&lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
&lt;/ds:Transforms&gt;
&lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
&lt;ds:DigestValue&gt;abEMP7cxDW8LwnvcUzr2dHmQesk=&lt;/ds:DigestValue&gt;
&lt;/ds:Reference&gt;
&lt;/ds:SignedInfo&gt;
&lt;ds:SignatureValue&gt;
#SIGNATURE#
&lt;/ds:SignatureValue&gt;
&lt;ds:KeyInfo&gt;
&lt;ds:X509Data&gt;
&lt;ds:X509Certificate&gt;
#CERTIFICATE#
&lt;/ds:X509Certificate&gt;
&lt;/ds:X509Data&gt;
&lt;/ds:KeyInfo&gt;
&lt;/ds:Signature&gt;&lt;saml:Subject&gt;
&lt;saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" NameQualifier="https://idp.ssocircle.com" SPNameQualifier="instance"&gt;ben&lt;/saml:NameID&gt;&lt;saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"&gt;
&lt;saml:SubjectConfirmationData NotOnOrAfter="2016-08-25T00:34:45Z" Recipient="http://10.88.111.163:8080/zport/dmd"/&gt;&lt;/saml:SubjectConfirmation&gt;
&lt;/saml:Subject&gt;&lt;saml:Conditions NotBefore="2016-08-25T00:14:45Z" NotOnOrAfter="2016-08-25T00:34:45Z"&gt;
&lt;saml:AudienceRestriction&gt;
&lt;saml:Audience&gt;instance&lt;/saml:Audience&gt;
&lt;/saml:AudienceRestriction&gt;
&lt;/saml:Conditions&gt;
&lt;saml:AuthnStatement AuthnInstant="2016-08-25T00:16:14Z" SessionIndex="s2e2b6d389c12dd386a118286d1228e159faee1901"&gt;&lt;saml:AuthnContext&gt;&lt;saml:AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport&lt;/saml:AuthnContextClassRef&gt;&lt;/saml:AuthnContext&gt;&lt;/saml:AuthnStatement&gt;&lt;saml:AttributeStatement&gt;&lt;saml:Attribute Name="EmailAddress"&gt;&lt;saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string"&gt;me@email.com&lt;/saml:AttributeValue&gt;&lt;/saml:Attribute&gt;&lt;saml:Attribute Name="FirstName"&gt;&lt;saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string"&gt;Ben&lt;/saml:AttributeValue&gt;&lt;/saml:Attribute&gt;&lt;/saml:AttributeStatement&gt;&lt;/saml:Assertion&gt;
&lt;/samlp:Response&gt;
</code></pre>