A SaaS application trusts an external identity provider. What must the relying party validate in a signed assertion?

1. Only the user's display name
2. The identity provider's marketing claims
3. Signature, issuer, audience and validity conditions
4. Only that the file is valid XML