Steps to generate Signature Value in SAML Response XML - saml

Question

I have a doubt about SignatureValue in SAML Response XML.
In some SAML tutorial I have read about Signature Value where we need to encrypt the SignatureValue using Private Key while sending to SP.
Do we really need to encrypt the SignatureValue at IDP side before sending to SP?
Because I was thinking that IDP will be sending the PublicKey to SP and SP will have the private key by which the payload can be verified at SP side whether there is any integrity issue.
Please need your valuable suggestion. Thank you in advance.
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
<ds:Reference URI="#_SAML-11">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
<ds:DigestValue>asdfsf2342sdfsaf1123132123sdfsafsafsdf</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>TkjljjlkljllTlkjlsjdljslakfjlsnfl2352nlkn2k3l5lknln2l35nlnlnl2k3nk5lknlkn23l5</ds:SignatureValue>
</ds:Signature>

Answer 1

we need to encrypt the SignatureValue using Private Key while sending to SP
I've never heard of such a thing, and I can't think of a commercial SAML product out there that supports encrypting the signature (or decrypting it). I'll also note that it isn't mentioned whatsoever in the spec. Additionally, I can't fathom how encrypting the SignatureValue will help - with anything.
As the IdP, you need to properly handle signing the XML (which is the area that 95% of the DIYers mess up), and then you need to provide your service providers with the appropriate public key so that the signature can be validated.

Answer 2

The IdP should digitally sign the SAML Response using its private key. Its public key is normally published in its SAML2 metadata, which the SP should have. The SP can then validate the signature on the SAML Response coming from the IdP. If anything is changed between the IdP and the SP, the signature won't validate.
In addition, some SPs require the IdP to encrypt the attributes in which case they will be in an EncryptedAssertion node.
You can see these in the SAML examples.

Answer 3

I have an experience of integration with about 6 vendors (aka service providers) via SAML. And I want to note that some service providers may avoid specific steps and do not require the signature or encryption. For example, they might be OK to have both Assertion and SAMLResponse signed, but not having Assertion encryption. Or some other way.
I've published some more details here and also some C# code on GitHub that might help you to figure out how to do certain steps. Let me know if it helps.