Re: [saml-dev] Signature with HTTP Redirect Binding

On 6/5/07,  <> wrote:
>
> So how does the receiver knows the public key to be used to verifiy the
> signature ?

Metadata.

> Does it have to maintain a list of all possible senders with their
> associated public key ?

Yes, in SAML metadata.

Tom