def verify_redirect_signature(saml_msg, cert=None, sigkey=None):
    """

    :param saml_msg: A dictionary with strings as values, *NOT* lists as
    produced by parse_qs.
    :param cert: A certificate to use when verifying the signature
    :return: True, if signature verified
    """

    try:
        signer = SIGNER_ALGS[saml_msg["SigAlg"]]
    except __HOLE__:
        raise Unsupported("Signature algorithm: %s" % saml_msg["SigAlg"])
    else:
        if saml_msg["SigAlg"] in SIGNER_ALGS:
            if "SAMLRequest" in saml_msg:
                _order = REQ_ORDER
            elif "SAMLResponse" in saml_msg:
                _order = RESP_ORDER
            else:
                raise Unsupported(
                    "Verifying signature on something that should not be "
                    "signed")
            _args = saml_msg.copy()
            del _args["Signature"]  # everything but the signature
            string = "&".join(
                [urllib.urlencode({k: _args[k]}) for k in _order if k in _args])
            if cert:
                _key = extract_rsa_key_from_x509_cert(pem_format(cert))
            else:
                _key = sigkey
            _sign = base64.b64decode(saml_msg["Signature"])

            return bool(signer.verify(string, _sign, _key))
dataset/ETHPy150Open cloudera/hue/desktop/core/ext-py/pysaml2-2.4.0/src/saml2/sigver.py/verify_redirect_signature