private static void validateSignature(Credential validationCredential,
                                          SamlParameters parameters,
                                          String messageParamName,
                                          boolean signatureRequired) {
        requireNonNull(validationCredential, "validationCredential");
        requireNonNull(parameters, "parameters");
        requireNonNull(messageParamName, "messageParamName");

        final String signature = parameters.getFirstValueOrNull(SIGNATURE);
        final String sigAlg = parameters.getFirstValueOrNull(SIGNATURE_ALGORITHM);

        if (signature == null || sigAlg == null) {
            if (signatureRequired) {
                throw new InvalidSamlRequestException("rejecting due to a missing signature");
            } else {
                return;
            }
        }

        // The order is one of the followings:
        // - SAMLRequest={value}&RelayState={value}=SigAlg={value}
        // - SAMLResponse={value}&RelayState={value}=SigAlg={value}
        final QueryParamsBuilder params = QueryParams.builder();
        params.add(messageParamName, parameters.getFirstValue(messageParamName));

        final String relayState = parameters.getFirstValueOrNull(RELAY_STATE);
        if (relayState != null) {
            params.add(RELAY_STATE, relayState);
        }
        params.add(SIGNATURE_ALGORITHM, sigAlg);

        final byte[] input = params.toQueryString().getBytes(StandardCharsets.UTF_8);

        try {
            final byte[] decodedSignature = Base64.getMimeDecoder().decode(signature);
            if (!XMLSigningUtil.verifyWithURI(validationCredential, sigAlg, decodedSignature, input)) {
                throw new InvalidSamlRequestException("failed to validate a signature");
            }
        } catch (IllegalArgumentException e) {
            throw new InvalidSamlRequestException("failed to decode a base64 signature string", e);
        } catch (SecurityException e) {
            throw new InvalidSamlRequestException("failed to validate a signature", e);
        }
    }
Validates a signature in the specified {@link AggregatedHttpRequest}.
saml/src/main/java/com/linecorp/armeria/server/saml/HttpRedirectBindingUtil.java