code: protected final void validateSamlProtocolResponse(final Response response, final SAML2MessageContext context,
                                                        final SignatureTrustEngine engine) {
  
          validateSuccess(response.getStatus());
  
          validateSignatureIfItExists(response.getSignature(), context, engine);
  
          validateIssueInstant(response.getIssueInstant());
  
          AuthnRequest request = null;
          final SAMLMessageStore messageStorage = context.getSAMLMessageStore();
          if (messageStorage != null && response.getInResponseTo() != null) {
              final Optional<XMLObject> xmlObject = messageStorage.get(response.getInResponseTo());
              if (!xmlObject.isPresent()) {
                  throw new SAMLInResponseToMismatchException("InResponseToField of the Response doesn't correspond to sent message "
                      + response.getInResponseTo());
              } else if (xmlObject.get() instanceof AuthnRequest) {
                  request = (AuthnRequest) xmlObject.get();
              } else {
                  throw new SAMLInResponseToMismatchException("Sent request was of different type than the expected AuthnRequest "
                      + response.getInResponseTo());
              }
          }
  
          verifyEndpoint(context.getSAMLEndpointContext().getEndpoint(), response.getDestination());
          if (request != null) {
              verifyRequest(request, context);
          }
  
          validateIssuerIfItExists(response.getIssuer(), context);
      }
docs: Validates the SAML protocol response:
  - IssueInstant
  - Issuer
  - StatusCode
  - Signature
  
  @param response the response
  @param context  the context
  @param engine   the engine