An identity provider issues an Assertion (subject, conditions such as NotBefore, NotOnOrAfter and AudienceRestriction, authentication statement and attributes), signs it with XML Signature, and delivers it in a Response through the browser, usually with the HTTP-POST binding. The service provider validates the signature against the IdP's certificate from metadata, the audience, the time window, the InResponseTo value and the destination URL.
Most serious SAML bugs are XML-processing bugs: signature wrapping (the verifier checks a signed element while the application reads a different, unsigned one), comment truncation in name identifiers (2018, several libraries), XML external entity expansion and signatures that cover only part of a response. Use a maintained library and never validate signatures with generic XPath code.
For new applications OpenID Connect is usually simpler, but enterprise customers often require SAML; many products run both. The SAML inspector decodes and checks assertions locally.