title: How to verify a SAML signature for HTTP-redirect binding
body: <p>I'm receiving a SAML request via HTTP-redirect binding the content of the SAML request look like this</p>
  
  <blockquote>
    <p>{"SigAlg"=>"<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" rel="noreferrer">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>",
    "SAMLRequest"=>"lVLLaoQwFP0VyT5jEqPG4AiFoSDMtNApXXQzxDxaQRObRDqfX3XoolAKXd7DPQ/uuXUQ4zDxo3tzc3zSH7MOMWkPe3DpcixzVVVQl4RBqoiCncEYEmkoY7k00hCQvGgfemf3gOwQSNoQZt3aEIWNC4RwCRGGiD6jkmPMs2KHUPYKksPi0lsRN+Z7jFPgafqpvejtbtQpSK7jYAPfsu3B7C13IvSBWzHqwKPk57vTkS+WfPIuOukG0NSbub9R/yaJELRfzUGzrhmtFut15qdeeheciY926K2u05toUz8sIu0huXd+FPFv9RXpFTTbKp/WA4WobQT/jEYrykwhNaQ66yDNMwY7wijEtMCmysqqo6xOb8Ga+tbjWYe1jtYqfW0uCucoYwWCHS3F0kRGoajWTpAiiJRZJRmu01+Y3+CPt2i+AA=="}</p>
  </blockquote>
  
  <p>It also has a Signature value </p>
  
  <blockquote>
    <p>WkDaGzC6vPTlzh+EnFA5/8IMmV7LviyRh2DA5EHF0K0nl+xzBlKfNCYRnunpwoEvGhereGdI5xBpv+mc9IguiCaLZSZjDh6lIDdpvctCnmSNzORqzWQwQGeZ9vjgtCLjUn35VZLNs3WgEqbi2cL+ObrUDS2gV1XvBA3Q3RRhoDmi+XE89Ztnd1cNpR3XdA+EL2ENbMI2XAD9qSgMufUJY/3GBBpT7Vg1ODtPxBudq+sXrgPh/+WtUUitLkkfC8tdRTCS1EZPv+h27I5g/VNza23Xl8w2HdAuYP0F2FjREo8VV2aUtaOUd/jAF9+bfkGV93y1PzFttLxdBbFoxp6qBg==</p>
  </blockquote>
  
  <p>But I fail to understand how to verify this signature is correct.</p>
  
  <p>Section 3.4.4.1 on SAML binding <a href="https://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf" rel="noreferrer">https://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf</a> </p>
  
  <pre><code>To construct the signature, a string consisting of the concatenation of the RelayState (if present),
  SigAlg, and SAMLRequest (or SAMLResponse) query string parameters (each one URLencoded)
  is constructed in one of the following ways (ordered as below):
  SAMLRequest=value&amp;RelayState=value&amp;SigAlg=value
  SAMLResponse=value&amp;RelayState=value&amp;SigAlg=value
  </code></pre>
  
  <p>I tried the approach but </p>
  
  <ul>
  <li><p>The signature I generated using the Private key does not match to the one I received from my SP. (posted above)</p></li>
  <li><p>Also, I'm not able to decrypt the signed message using the Private key (I'm assuming the Signature was created using the public that I federated it with.)</p></li>
  </ul>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;samlp:LogoutRequest ID="_36167d94-d868-4c04-aee3-8bbd4ed91317" Version="2.0" IssueInstant="2017-01-05T16:21:55.704Z" Destination="https://werain.me/" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"&gt;&lt;Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion"&gt;urn:federation:MicrosoftOnline&lt;/Issuer&gt;&lt;NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" xmlns="urn:oasis:names:tc:SAML:2.0:assertion"&gt;4948f6ce-4e3b-4538-b284-1461f9379b48&lt;/NameID&gt;&lt;samlp:SessionIndex&gt;_eafbb730-b590-0134-a918-00d202739c81&lt;/samlp:SessionIndex&gt;&lt;/samlp:LogoutRequest&gt;</code></pre>
  </div>
  </div>
  </p>
  
  <p>Any help here.</p>