OpenSAML user discussion

[John Gonzales <>]

Hi all,

I'm trying to validate a signature that is being sent along with a 
SAMLResponse to my service provider via the HTTPRedirect protocol binding.

I have successfully decoded the SAMLResponse and now I want to validate 
the signature. I used this Wiki document as my guide: 
https://spaces.internet2.edu/display/OpenSAML/OSTwoUserManJavaDSIG

My code is pretty much the same as the low-level validation example, but 
here it is anyway:

        SignatureValidator signatureValidator = new 
SignatureValidator(SAMLCredentialManager.getInstance().getIdentityProviderSigningCredential(null));

        try {
            signatureValidator.validate(samlResponse.getSignature());
            return true;
        } catch (ValidationException e) {
            log.error("Signature is invalid", e);
        }

        return false;

I used HTTPRedirectDeflateDecoder to create the samlResponse object.

However, when signatureValidator.validate() executes, I get a 
NullPointerException being thrown because the value of 
samlResponse.getSignature() is null.

Any suggestions?