private boolean validateSignatureOnAuthenticationRequest(final RequestAbstractType profileRequest,
                                                          final HttpServletRequest request,
                                                          final MessageContext context,
                                                          final RoleDescriptorResolver roleDescriptorResolver) throws Throwable {
        val peer = context.ensureSubcontext(SAMLPeerEntityContext.class);
        peer.setEntityId(SamlIdPUtils.getIssuerFromSamlObject(profileRequest));

        val peerEntityId = Objects.requireNonNull(peer.getEntityId());
        LOGGER.debug("Validating request signature for [{}]...", peerEntityId);

        val roleDescriptor = roleDescriptorResolver.resolveSingle(
            new CriteriaSet(new EntityIdCriterion(peerEntityId),
                new EntityRoleCriterion(SPSSODescriptor.DEFAULT_ELEMENT_NAME)));
        peer.setRole(roleDescriptor.getElementQName());
        val protocol = context.ensureSubcontext(SAMLProtocolContext.class);
        protocol.setProtocol(SAMLConstants.SAML20P_NS);

        LOGGER.debug("Building security parameters context for signature validation of [{}]", peerEntityId);
        val secCtx = context.ensureSubcontext(SecurityParametersContext.class);
        val validationParams = new SignatureValidationParameters();

        if (overrideBlockedSignatureAlgorithms != null && !overrideBlockedSignatureAlgorithms.isEmpty()) {
            validationParams.setExcludedAlgorithms(this.overrideBlockedSignatureAlgorithms);
            LOGGER.debug("Validation override blocked algorithms are [{}]", this.overrideAllowedAlgorithms);
        }

        if (overrideAllowedAlgorithms != null && !overrideAllowedAlgorithms.isEmpty()) {
            validationParams.setIncludedAlgorithms(this.overrideAllowedAlgorithms);
            LOGGER.debug("Validation override allowed algorithms are [{}]", this.overrideAllowedAlgorithms);
        }

        LOGGER.debug("Resolving signing credentials for [{}]", peerEntityId);
        val credentials = getSigningCredential(roleDescriptorResolver, profileRequest);
        if (credentials.isEmpty()) {
            throw new SamlException("Signing credentials for validation could not be resolved");
        }

        var foundValidCredential = false;
        val it = credentials.iterator();
        while (!foundValidCredential && it.hasNext()) {
            foundValidCredential = FunctionUtils.doAndHandle(() -> {
                val handler = new SAML2HTTPRedirectDeflateSignatureSecurityHandler();
                val credential = it.next();
                val resolver = new StaticCredentialResolver(credential);
                val keyResolver = new StaticKeyInfoCredentialResolver(credential);
                val trustEngine = new ExplicitKeySignatureTrustEngine(resolver, keyResolver);
                validationParams.setSignatureTrustEngine(trustEngine);
                secCtx.setSignatureValidationParameters(validationParams);

                handler.setHttpServletRequestSupplier(() -> request);
                LOGGER.debug("Initializing [{}] to execute signature validation for [{}]", handler.getClass().getSimpleName(), peerEntityId);
                handler.initialize();
                LOGGER.debug("Invoking [{}] to handle signature validation for [{}]", handler.getClass().getSimpleName(), peerEntityId);
                handler.invoke(context);
                LOGGER.debug("Successfully validated request signature for [{}].", profileRequest.getIssuer());
                handler.destroy();
                return true;
            }, e -> {
                LOGGER.debug(e.getMessage(), e);
                return false;
            }).get();
        }

        FunctionUtils.throwIf(!foundValidCredential, () -> {
            LOGGER.error("No valid credentials could be found to verify the signature for [{}]", profileRequest.getIssuer());
            return new SamlException("No valid signing credentials for authentication request validation could be resolved");
        });
        return true;
    }
Validate authn request signature.

@param profileRequest the authn request
@param adaptor        the adaptor
@param request        the request
@param context        the context
@return true or false
@throws Throwable the throwable
support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/builders/enc/validate/SamlObjectSignatureValidator.java