First, you select the signed element(s) to verify.

Next, you select the signature methods and digest methods that you are permitting. Optionally indicate whether to gather the signing certificates as credentials.

The "Check" assertion then checks the <prefix>.elementsVerified variable for the signed elements and notes the index position of any matches. (This is similar to using the Look Up Item by Value assertion on the <prefix>.elementsVerified variable.)

If a match is found, the assertion then checks whether the corresponding index position in the <prefix>.signatureMethodUris variable matches any of the "Permitted signature methods". (This is similar to using the Look Up Item by Index Position assertion on the <prefix>.signatureMethodUris variable, followed by an At Least One Assertion Must Evaluate to True assertion containing one or more Compare Expression assertion to check the value.)

If a match is found, the same thing is repeated on the corresponding index position in the <prefix>.digestMethodUris variable to see if it matches any of the "Permitted digest methods". (This is similar to using the Look Up Item by Index Position assertion on the <prefix>.digestMethodUris variable, followed by an At Least One Assertion Must Evaluate to True assertion containing one or more Compare Expression assertion to check the value.)

If a match is found and you are gathering signing certificates, the assertion retrieves the certificate from the corresponding index position in the <prefix>.signingCertificates variable and gathers it as X.509 credentials.

Do one of the following:

To add the assertion to the Policy Development window, see Add an Assertion.
To change the configuration of an existing assertion, proceed to step 2 below.

Right-click<

target

>:

(Non-SOAP) Check Results from XML Verification

[

XPath

] in the policy window and select

(Non-SOAP) XML Verification Properties

or double-click the assertion in the policy window. The assertion properties are displayed. 

Click [

Edit XPath

] to specify the signed element(s) to verify. For more information, see Select an XPath.

Enter the context variable prefix that was used in the (Non-SOAP) Verify XML Element assertion. If no prefix was used, leave the field blank.

Select the

Gather signer certificate(s) as credentials

check box if you want to use the signing certificate as an X.509 credential for later authorization with a specific User or Member of Group assertion. See Retrieve Credentials from Context Variable Assertion.

Click [

OK

].