title: Verify signature on SAML assertion
body: <p>I have two signatures, one on the response (which verifies) and one on the nested SAML assertion (which does not). This is the condensed code I'm working with:</p>
  
  <pre class="lang-cs prettyprint-override"><code>foreach (XmlElement node in xmlDoc.SelectNodes("//*[local-name()='Signature']"))
  {// Verify this Signature block
      SignedXml signedXml = new SignedXml(node.ParentNode as XmlElement);
      signedXml.LoadXml(node);
      KeyInfoX509Data x509Data = signedXml.Signature.KeyInfo.OfType&lt;KeyInfoX509Data&gt;().First();
  
      // Verify certificate
      X509Certificate2 cert = x509Data.Certificates[0] as X509Certificate2;
      log.Info(string.Format("Cert s/n: {0}", cert.SerialNumber));
      VerifyX509Chain(cert);// Custom method
  
      // Check for approval
      X509Store store = new X509Store(StoreName.TrustedPublisher, StoreLocation.LocalMachine);
      store.Open(OpenFlags.ReadOnly);
      X509Certificate2Collection collection = store.Certificates.Find(X509FindType.FindBySerialNumber, cert.SerialNumber, true);
      Debug.Assert(collection.Count == 1);// Standing in for brevity
  
      // Verify signature
      signedXml.CheckSignature(cert, true);
  }
  </code></pre>
  
  <p>For completeness, here's an outline of the XML:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;samlp2:Response Destination="http://www.testhabaGoba.com" ID="ResponseId_934151edfe060ceec3067670c2f0f1ea" IssueInstant="2013-09-24T14:33:29.507Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp2="urn:oasis:names:tc:SAML:2.0:protocol"&gt;
      ...
      &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
          ...
      &lt;/ds:Signature&gt;
      ...
      &lt;saml2:Assertion ID="SamlAssertion-05fd8af7f2c9972e69cdbca612d3f3b8" IssueInstant="2013-09-24T14:33:29.496Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"&gt;
          ...
          &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
              ...
          &lt;/ds:Signature&gt;
          ...
      &lt;/saml2:Assertion&gt;
  &lt;/samlp2:Response&gt;
  </code></pre>
  
  <p>I've also tried with just the assertion signed, and that fails as well. What am I doing wrong? Why does <a href="http://msdn.microsoft.com/en-us/library/ms148731(v=vs.110).aspx" rel="nofollow">CheckSignature</a> always fail on the SAML assertion?</p>
  
  <p><strong>Edit</strong>
  Turns out the one with just the assertion signed is Java-generated (OpenSAML) and has more hoops to jump through. Please advise.</p>