Search code examples
public-key-encryptionsaml-2.0signing

Which public key (SP or remote IDP) to use while signing SAML request

I am trying to configure my application (SP) to work with remote IDP. The IDP provided me with a certificate to configure with SP. For SAML request, do I use SP's public key or IDP's? Also, where can I find good resources to study SAML in detail (apart from the oasis formal documents). The tutorials that I find are very simplistic (i.e. they just describe that SP goes to IDP and then it is redirected back but do not go into detail on SAML messages). The oasis documents are confusing. Thanks for any answers

Solution

  • I'm not 100% sure, but it looks from these two sources that you should sign with your (SP's) private key and share the associated public key with the IdP so they can verify the signature.