Validating incoming SAML Responses?

[gCurtisCT]

How do you validate incoming SAML responses?

The documentation says to provide the "cert" option, and I'm doing that:

new SamlStrategy(
    {
    path:'/authorization/saml',
    cert:cert
},
function(profile, done){
    //...

, but when I go in and edit the cert by a character, making it invalid, it still works just fine, which suggests that it's not actually validating anything.

I'm testing this by using Okta as the identity provider. Perhaps I'm not setting some Okta option right?

My Okta options: