RE: [saml-dev] SAMLResponse validation

["Peter Buus" <peter@signaturgruppen.dk>]

> Strange.
>
> Are you sure that you sign the response with the private key associated with "MyIDP" (and not "MyCA")?
>
> If this is the case, then "MyCA" should not be able to verify the signature (but onle "MyIDP") and if your response does not contain "MyIDP", then the knowledge of "MyCA" 
>  (alone) should not be able to guess "MyIDP".

Yes - I am sure the scenario is as described
Yes - I am convinced that this is an obvious and severe error in the loadbalancers SAML validation
No - I have not been able to make the vendor realize their error
No - I have not been able to find the specification stating that you need to validate the SAML Assertion against the IDP certificate - and not just the issuing CA