if (deployment.getIDP().getSingleSignOnService().validateAssertionSignature()) { try { if (!AssertionUtil.isSignatureValid(getAssertionFromResponse(responseHolder), deployment.getIDP().getSignatureValidationKeyLocator())) {
if (deployment.getIDP().getSingleSignOnService().validateAssertionSignature()) { try { if (!AssertionUtil.isSignatureValid(getAssertionFromResponse(responseHolder), deployment.getIDP().getSignatureValidationKeyLocator())) {