ITfoxtec.Identity.Saml2 | ITfoxtec Identity Saml2 adds SAML-P support | Authentication library

I have created an IDP using the code contained within https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2/blob/master/test/TestIdPCore/Controllers/AuthController.cs

This is throwing an error when I attempt to bind the authNResponse using the following code:

We are getting "Signature is invalid" errors while calling Unbind() and stumbled upon this in code. https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2/blob/42a2d6de46f38d14f0c6f607594d19f2366ad5f2/src/ITfoxtec.Identity.Saml2/Bindings/Saml2PostBinding.cs#L106

Why validateXmlSignature argmument is always true within UnbindInternal()?

I have one IdP and two SP's (A and B) setup. SSO works great between them. Single Logout also works when I logout from site A (it logs user out from site B too) but issue occurs when I am trying to logout from site B. It logs user out from site B but when I navigate to site A I'm still logged in until I delete session cookies or sessions times out.

Site A uses ITfoxtec.Identity.Saml2 SAML2.0 MVC implementation.

If I manually delete cookies and refresh the page I'm redirected to login page.

It seems that it kills the session but session cookies persists in the browser and it lets user to browse until it expires, it cannot renew it.

SingleLogout endpoint is the same as in example (Source from ITfoxtec.Identity.Saml2 - TestWebApp)

Have you seen anything like it? I ran out of ideas what could be done in this case.

I'm trying to integrate OpenAM Saml SSO to my .net 5 application. ITfoxtec.Saml2 is used to handle the authentication on the SP. When trying to login, a valid post samlResponse is send. But when validating the response, I get following exception.

I'm writing a SAML2 service provider/relying party. My IdP is returning Assertions in an encrypted form (EncryptedAssertion element). Is this Assertion decryption scenario supported by ITfoxtec.Identity.Saml2? I'm getting this exception:

I am trying to setup an authentication mechanism based on the new OIOSAML3.0. Using your https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2/tree/master/test/TestWebAppCoreNemLogin3Sp works fine for me.

However, having moved the various startup calls over into my own code I get a HTTP 404 on the redirects to '/idp/saml/3.0/?...'

The same thing happends when I take your example, but change over to my own organisation metadata.

I thought these endpoints would be setup by the call to AddSaml2() and UseSaml2() in Startup.cs but that does not seem to be the case.

Can you lend any insight into where and how these endspoints are added to the project?

We have an asp.net 5 web app that will serve as a Service Provider to our users.
We have chosen ITfoxtec Identity SAML 2.0 library for this purpose.
The request is successful, but in the response we get the following error:

System.ArgumentException: IDX13300: 'System.String' must be an absolute Uri, was: 'System.Uri'

For completeness here is the full stack trace:

Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityTokenReadException: IDX13102: Exception thrown while reading 'System.String' for Saml2SecurityToken. Inner exception: 'System.ArgumentException'. ---> System.ArgumentException: IDX13300: 'System.String' must be an absolute Uri, was: 'System.Uri' at Microsoft.IdentityModel.Tokens.Saml2.Saml2AuthenticationContext.set_DeclarationReference(Uri value) at Microsoft.IdentityModel.Tokens.Saml2.Saml2Serializer.ReadAuthenticationContext(XmlDictionaryReader reader) --- End of inner exception stack trace --- at Microsoft.IdentityModel.Tokens.Saml2.Saml2Serializer.ReadAuthenticationContext(XmlDictionaryReader reader) at Microsoft.IdentityModel.Tokens.Saml2.Saml2Serializer.ReadAuthenticationStatement(XmlDictionaryReader reader) at Microsoft.IdentityModel.Tokens.Saml2.Saml2Serializer.ReadAssertion(XmlReader reader) at Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityTokenHandler.ReadSaml2Token(XmlReader reader) at Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityTokenHandler.ReadSaml2Token(String token) at ITfoxtec.Identity.Saml2.Saml2AuthnResponse.ReadSecurityToken(String tokenString) at ITfoxtec.Identity.Saml2.Saml2AuthnResponse.Read(String xml, Boolean validateXmlSignature) at ITfoxtec.Identity.Saml2.Saml2PostBinding.Read(HttpRequest request, Saml2Request saml2RequestResponse, String messageName, Boolean validateXmlSignature) at ITfoxtec.Identity.Saml2.Saml2Binding1.ReadSamlResponse(HttpRequest request, Saml2Response saml2Response) at SsoGovILApi.Controllers.SamlController.AssertionConsumerService() in F:\Dev\ashilon\SsoGovIlApi\Controllers\SamlController.cs:line 45 at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.TaskOfIActionResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.g__Awaited|12_0(ControllerActionInvoker invoker, ValueTask1 actionResultValueTask) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.g__Awaited|10_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeInnerFilterAsync() --- End of stack trace from previous location --- at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.g__Awaited|19_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted) at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.g__Logged|17_1(ResourceInvoker invoker) at Microsoft.AspNetCore.Routing.EndpointMiddleware.g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger) at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context) at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context) at Serilog.AspNetCore.RequestLoggingMiddleware.Invoke(HttpContext httpContext) at Microsoft.AspNetCore.Builder.Extensions.UsePathBaseMiddleware.Invoke(HttpContext context) at Microsoft.AspNetCore.Server.IIS.Core.IISHttpContextOfT1.ProcessRequestAsync()

I have looked up the error and found that the authentication context can be ignored, and some libraries give this option, like this one for example:
IgnoreAuthenticationContextInResponse compatibility flag

Is there a way to this in the ITfoxtec library too?

Thanks in advance,
ashilon

I feel like I'm missing something, either in my understanding of SSO, or in how IdP-initiated in the example projects (MVC and Core) at ITFoxtec.Identity.Saml2 are working.

It seems like the only project set up to be the IdP is TestIdPCore, yet the only projects that have IdPInitiatedController seem to be set up to only be an Service Provider (relying party?).

I dropped IdPInitiatedController into TestIdPCore and was able to get Initiate() to work.

I guess I am confused on how to get IdP-initiated working with the examples as they are.

Thank you for your time, both in the work done and in your responses!

I'm validating AAD-SSO for TestWebApp(ASP.NET MVC) ITfoxtec / ITfoxtec.Identity.Saml2.
I confirmed login -> AAD sign-in -> Redirect to app but app still remains not logging-in.
I assigned "https://localhost:***/Metadata" as Redirect Uri.
I checked the other settings from another post. However that means the app only makes a xml file.

Tell the procedure if there's anyone who succeeded logging-in on app?
Or do I have to build new logic?
e.g. of logic) receive session from AAD and