code: private static void validateSignature(Credential validationCredential,
                                            SamlParameters parameters,
                                            String messageParamName) {
          requireNonNull(validationCredential, "validationCredential");
          requireNonNull(parameters, "parameters");
          requireNonNull(messageParamName, "messageParamName");
  
          final String signature = parameters.getFirstValue(SIGNATURE);
          final String sigAlg = parameters.getFirstValue(SIGNATURE_ALGORITHM);
  
          // The order is one of the followings:
          // - SAMLRequest={value}&RelayState={value}=SigAlg={value}
          // - SAMLResponse={value}&RelayState={value}=SigAlg={value}
          final QueryStringEncoder encoder = new QueryStringEncoder("");
          encoder.addParam(messageParamName, parameters.getFirstValue(messageParamName));
  
          final String relayState = parameters.getFirstValueOrNull(RELAY_STATE);
          if (relayState != null) {
              encoder.addParam(RELAY_STATE, relayState);
          }
          encoder.addParam(SIGNATURE_ALGORITHM, sigAlg);
  
          final byte[] input = encoder.toString().substring(1).getBytes(StandardCharsets.UTF_8);
  
          try {
              final byte[] decodedSignature = Base64.getMimeDecoder().decode(signature);
              if (!XMLSigningUtil.verifyWithURI(validationCredential, sigAlg, decodedSignature, input)) {
                  throw new SamlException("failed to validate a signature");
              }
          } catch (IllegalArgumentException e) {
              throw new SamlException("failed to decode a base64 signature string", e);
          } catch (SecurityException e) {
              throw new SamlException("failed to validate a signature", e);
          }
      }
docs: Validates a signature in the specified {@link AggregatedHttpMessage}.