title: Verify SAML assertion signature in .Net core 3.1
body: <p>I have an XML of SAML assertion and I can't figure out what is wrong with this verification. Also I cannot use any libraries from the full .Net Framework (here I use  <code>Microsoft.IdentityModel.Tokens</code> and  <code>Microsoft.IdentityModel.Tokens.Saml</code> packages).</p>
  <pre><code>XmlReader xmlReader = XmlReader.Create(new StringReader(xml));            
  RsaSecurityKey key = new RsaSecurityKey(RSA.Create());            
  SamlSerializer ser = new SamlSerializer();
  var assertion = ser.ReadAssertion(xmlReader);            
  assertion.Signature.Verify(key);
  </code></pre>
  <p>The <code>ReadAssertion</code> is OK and the certificate is there inside <code>Signature.KeyInfo.X509Data</code>.
  Or maybe I'm using a wrong SecurityKey and <code>RsaSecurityKey</code> is not the right choice for this? I'm not really sure how to interpret the <code>Signature</code> part of this:</p>
  <pre><code>        &lt;saml:Assertion MajorVersion=&quot;1&quot; MinorVersion=&quot;1&quot; AssertionID=&quot;_466e5c77-b0d7-4c5e-a652-ec66f520302e&quot; Issuer=&quot;http://www.example.com/sts.6&quot; IssueInstant=&quot;2021-11-02T12:55:44.273Z&quot; xmlns:saml=&quot;urn:oasis:names:tc:SAML:1.0:assertion&quot;&gt;
              &lt;saml:Conditions NotBefore=&quot;2021-11-02T12:55:44.273Z&quot; NotOnOrAfter=&quot;2021-11-02T16:55:44.273Z&quot;&gt;
                  &lt;saml:AudienceRestrictionCondition&gt;
                      &lt;saml:Audience&gt;https://www.example.com/prod&lt;/saml:Audience&gt;
                  &lt;/saml:AudienceRestrictionCondition&gt;
              &lt;/saml:Conditions&gt;
              &lt;saml:AttributeStatement&gt;
                  ...
              &lt;/saml:AttributeStatement&gt;
              &lt;saml:AuthenticationStatement AuthenticationMethod=&quot;URN:IVIS:100001:AM.BANK-SWED&quot; AuthenticationInstant=&quot;2021-11-02T12:55:44.085Z&quot;&gt;
                  &lt;saml:Subject&gt;
                      &lt;saml:NameIdentifier Format=&quot;urn:ivis:100001:name.id-viss&quot;&gt;PK:08028710315&lt;/saml:NameIdentifier&gt;
                      &lt;saml:SubjectConfirmation&gt;
                          &lt;saml:ConfirmationMethod&gt;urn:oasis:names:tc:SAML:1.0:cm:bearer&lt;/saml:ConfirmationMethod&gt;
                      &lt;/saml:SubjectConfirmation&gt;
                  &lt;/saml:Subject&gt;
                  &lt;saml:SubjectLocality IPAddress=&quot;87.242.186.212&quot;/&gt;
              &lt;/saml:AuthenticationStatement&gt;
              &lt;Signature xmlns=&quot;http://www.w3.org/2000/09/xmldsig#&quot;&gt;
                  &lt;SignedInfo&gt;
                      &lt;CanonicalizationMethod Algorithm=&quot;http://www.w3.org/2001/10/xml-exc-c14n#&quot;/&gt;
                      &lt;SignatureMethod Algorithm=&quot;http://www.w3.org/2001/04/xmldsig-more#rsa-sha256&quot;/&gt;
                      &lt;Reference URI=&quot;#_466e5c77-b0d7-4c5e-a652-ec66f520302e&quot;&gt;
                          &lt;Transforms&gt;
                              &lt;Transform Algorithm=&quot;http://www.w3.org/2000/09/xmldsig#enveloped-signature&quot;/&gt;
                              &lt;Transform Algorithm=&quot;http://www.w3.org/2001/10/xml-exc-c14n#&quot;/&gt;
                          &lt;/Transforms&gt;
                          &lt;DigestMethod Algorithm=&quot;http://www.w3.org/2001/04/xmlenc#sha256&quot;/&gt;
                          &lt;DigestValue&gt;VAOQYRxyrO+pJs9+pGjQWOXoR5SFTKHhG3lmpFS0TeQ=&lt;/DigestValue&gt;
                      &lt;/Reference&gt;
                  &lt;/SignedInfo&gt;
                  &lt;SignatureValue&gt;BjslVMuLfUcbNMiJPpTiqmr/WgI/ZuzXfRV...gGFrdW/cH/BFrJfiq9oWlQcFLVD/GFsq3XQw==&lt;/SignatureValue&gt;
                  &lt;KeyInfo&gt;
                      &lt;X509Data&gt;
                          &lt;X509Certificate&gt;MIIF7jCCBNagAwIBAgIKEqni0gABAAABQz...4LsBscidh0/nNcAJwOVlCfw==&lt;/X509Certificate&gt;
                      &lt;/X509Data&gt;
                  &lt;/KeyInfo&gt;
              &lt;/Signature&gt;
          &lt;/saml:Assertion&gt;
  </code></pre>