I am able to login and receving SAMLResponse through HTTP-Redirect binding and also I can able to decrypt using privatekey and able to retrive claims.
My question is still do we need to verify saml response(ADFS)? if its how to do that
do I need to use IP(identity provider) public key ? will it available in IP(Metadata)?
I have SAML response in the following request parameter
SAMLResponse = base64(deflate(data))
signature = hashvalue
sigAlg = sha256
how to validate?
Yes you need to also verify the digital signature of the SAML response. This is because the encryption is done using your public this is available to anyone that has access to your metadata and does not give any assurance that it was produces by your IdP.
To verify that you IdP is the one that produced the SAMLResponse you verify the digital signature of the SAMLResponse using the IdP public key. This is typically available in the IdP metadata.
How to verify ADFS encrypted SAML Response (Assertion)