public boolean validateRequestSignature(HttpServletRequest request,Boolean mustSigned) throws Exception {
  Validate.notNull(request,"HttpServletRequest");
  String signatureRawQueryString=HTTPTransportUtils.getRawQueryStringParameter(request.getQueryString(),SamlUtils.SIGNATURE_PARAMETER);
  String sigAlgRawQueryString=HTTPTransportUtils.getRawQueryStringParameter(request.getQueryString(),SamlUtils.SIGNATURE_ALGORITHM_PARAMETER);
  ;
  if (StringUtils.isEmpty(signatureRawQueryString) || StringUtils.isEmpty(sigAlgRawQueryString))   if (mustSigned) {
    String errMsg="Http request query string missing signature or algorithm.";
    log.error(errMsg);
    throw new IllegalArgumentException(errMsg);
  }
 else {
    return false;
  }
  try {
    Validate.notNull(getCertificate(),"Certificate");
    String signature=signatureRawQueryString.split("=")[1];
    String algorithmUri=sigAlgRawQueryString.split("=")[1];
    String signedContent=parseSignedMessage(request);
    verifySignature(signedContent,signature,algorithmUri);
    log.info("Successfully validated SAML message signature. ");
  }
 catch (  Exception e) {
    log.error("Unable to verify signature of the query string. ",e);
    throw e;
  }
  return true;
}

public boolean validateRequestSignature ( HttpServletRequest request , Boolean mustSigned ) throws Exception { Validate . notNull ( request , "HttpServletRequest" ) ; String signatureRawQueryString = HTTPTransportUtils . getRawQueryStringParameter ( request . getQueryString ( ) , SamlUtils . SIGNATURE_PARAMETER ) ; String sigAlgRawQueryString = HTTPTransportUtils . getRawQueryStringParameter ( request . getQueryString ( ) , SamlUtils . SIGNATURE_ALGORITHM_PARAMETER ) ; ; if ( StringUtils . isEmpty ( signatureRawQueryString ) || StringUtils . isEmpty ( sigAlgRawQueryString ) ) if ( mustSigned ) { String errMsg = "Http request query string missing signature or algorithm." ; log . error ( errMsg ) ; throw new IllegalArgumentException ( errMsg ) ; } else { return false ; } try { Validate . notNull ( getCertificate ( ) , "Certificate" ) ; String signature = signatureRawQueryString . split ( "=" ) [ 1 ] ; String algorithmUri = sigAlgRawQueryString . split ( "=" ) [ 1 ] ; String signedContent = parseSignedMessage ( request ) ; verifySignature ( signedContent , signature , algorithmUri ) ; log . info ( "Successfully validated SAML message signature. " ) ; } catch ( Exception e ) { log . error ( "Unable to verify signature of the query string. " , e ) ; throw e ; } return true ; }
validate signature in the http request . exception throw if fails to verify the signature when the request must be signed .
