title: Can WIF Saml2SecurityTokenHandler validate top-level signature?
body: <p>See this (stripped-down) SAML 2.0 response:</p>
  
  <pre><code>&lt;samlp:Response&gt;
    &lt;saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"&gt;lkasjdflkasj&lt;/saml:Issuer&gt;
    &lt;Signature xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
      &lt;!--&lt;snip&gt;--&gt;
    &lt;/Signature&gt;
    &lt;samlp:Status xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"&gt;
      &lt;samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/&gt;
    &lt;/samlp:Status&gt;
    &lt;saml:Assertion&gt;
      &lt;saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"&gt;lkasjdflkasj&lt;/saml:Issuer&gt;
      &lt;saml:Subject&gt;
        &lt;saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"&gt;jsmith&lt;/saml:NameID&gt;
        &lt;!--&lt;snip&gt;--&gt;
      &lt;/saml:Subject&gt;
      &lt;!--&lt;snip, but there was NOT a Signature node inside the assertion&gt;--&gt;
    &lt;/saml:Assertion&gt;
  &lt;/samlp:Response&gt;
  </code></pre>
  
  <p>In the code below, the xml reader is set to send just the <code>&lt;Assertion&gt;</code> piece of the SAML 2.0 response:</p>
  
  <pre><code>var handlers = FederatedAuthentication.FederationConfiguration.IdentityConfiguration.SecurityTokenHandlers;
  var token = handlers.ReadToken( myXmlReader );
  var identities = handlers.ValidateToken( token );
  </code></pre>
  
  <p>If the <code>&lt;Signature&gt;</code> node is part of the assertion, then <code>ValidateToken()</code> will verify it using config settings, e.g. <code>issuerNameRegistry</code> (example in <a href="https://stackoverflow.com/questions/28845076/wif-config-issuernameregistry-vs-certificatevalidation">this question</a>).</p>
  
  <p>But if the signature is at a higher level (i.e. the whole xml is signed, not just the assertion), then we'll get an exception like:</p>
  
  <blockquote>
    <p>ID4152: The Saml2SecurityToken cannot be validated because the IssuerToken property is not set. Unsigned SAML2:Assertions cannot be validated.</p>
  </blockquote>
  
  <p>Am I understanding correctly that if the <code>&lt;Signature&gt;</code> exists only on the overall xml response, that I cannot call <code>ValidateToken</code> and must instead revert to more general-purpose features such as <a href="https://msdn.microsoft.com/en-us/library/ye0db953%28v=vs.110%29.aspx" rel="nofollow noreferrer">SignedXml.CheckSignature</a>?</p>