question: public static boolean verifyMessage ( Message m ) { try { Document doc = m . toDocument ( false ) ; Certificate clientCert = ( Certificate ) m . getPeerCertificate ( ) ; Certificate messageCert = ( Certificate ) m . getMessageCertificate ( ) ; int securityProfileType = m . getSecurityProfileType ( ) ; if ( securityProfileType == Message . SAML_TOKEN || securityProfileType == Message . BEARER_TOKEN ) { SecurityAssertion assertion = m . getAssertion ( ) ; String certAlias = null ; Certificate signingCert = getAssertionSigningCert ( assertion ) ; if ( signingCert == null ) { certAlias = ( String ) issuerTrustedCACertAliases . get ( assertion . getIssuer ( ) ) ; if ( certAlias == null ) { debug . error ( "SecurityUtils.verifyMessage: " + "assertion doesn't have keyInfo and " + "issuer is not in " + "com.sun.identity.liberty.ws.trustedca.certalias" + " in AMConfig" ) ; return false ; } } else { certAlias = keystore . getCertificateAlias ( signingCert ) ; if ( certAlias == null ) { debug . error ( "SecurityUtils.verifyMessage: " + "assertion is signed with a certificate that " + " is not in the keystore" ) ; return false ; } else if ( ! trustedCACertAliases . contains ( certAlias ) ) { debug . error ( "SecurityUtils.verifyMessage: " + "assertion is signed with a certificate that " + " is in the keystore but not in " + "com.sun.identity.liberty.ws.trustedca.certalias" + " in AMConfig" ) ; return false ; } } assertion . setVerifyingCertAlias ( certAlias ) ; if ( ! assertion . isSignatureValid ( ) ) { debug . error ( "SecurityUtils.verifyMessage: assertion " + "signature invalid" ) ; return false ; } if ( debug . messageEnabled ( ) ) { debug . message ( "SecurityUtils.verifyMessage: Assertion " + " signing cert alias = " + certAlias ) ; } } if ( ( clientCert != null ) && ( ! clientCert . equals ( messageCert ) ) ) { debug . error ( "Client authentication certificate is not " + "the same as the certificate inside the " + "soap message" ) ; return false ; } if ( messageCert != null ) { String messageCertAlias = keystore . getCertificateAlias ( messageCert ) ; return sm . verifyXMLSignature ( m . getWSFVersion ( ) , messageCertAlias , doc ) ; } return true ; } catch ( Exception e ) { debug . error ( "Unable to verify Soap Message!" , e ) ; } return false ; }
target:  Verify all the signatures of the of Message object passed from Soap Binding.