Class SamlRedirectBinding
- Namespace
- Fdyay.IdentityServer.Saml.Bindings
- Assembly
- Fdyay.IdentityServer.Saml.dll
The HTTP-Redirect binding: DEFLATE-compressed, base64-encoded, URL-encoded messages carried on the query string.
public static class SamlRedirectBinding- Inheritance
-
SamlRedirectBinding
- Inherited Members
Methods
BuildRequestQuery(string, string?)
Builds the query string (without a leading '?') for a redirect-bound request.
public static string BuildRequestQuery(string xml, string? relayState = null)Parameters
Returns
BuildResponseQuery(string, string?)
Builds the query string (without a leading '?') for a redirect-bound response.
public static string BuildResponseQuery(string xml, string? relayState = null)Parameters
Returns
Remarks
The same shape as BuildRequestQuery(string, string?) under the other parameter name. It exists because a
service provider answering an inbound LogoutRequest has one URL for the identity provider and it
is a redirect-binding one; until 0.60.0 nothing in this assembly could put a response on that binding,
which is part of why nothing answered.
BuildSignedRequestQuery(string, string?, X509Certificate2)
Builds the query string for a redirect-bound request carrying a detached signature (Bindings §3.4.4.1).
public static string BuildSignedRequestQuery(string xml, string? relayState, X509Certificate2 signingCertificate)Parameters
xmlstringrelayStatestringsigningCertificateX509Certificate2
Returns
Remarks
The signature covers the query built so far — SAMLRequest, RelayState when there is
one, then SigAlg — exactly as encoded here, so the bytes signed are the bytes sent. The
algorithm follows the certificate's key, so SigAlg names what actually signed rather than
what this method used to assume.
BuildSignedRequestQuery(string, string?, X509Certificate2, string?)
The same, signed with the method named, or the one the key implies when it is null.
public static string BuildSignedRequestQuery(string xml, string? relayState, X509Certificate2 signingCertificate, string? signatureMethod)Parameters
xmlstringrelayStatestringsigningCertificateX509Certificate2signatureMethodstring
Returns
BuildSignedResponseQuery(string, string?, X509Certificate2)
Builds the query string for a redirect-bound response carrying a detached signature.
public static string BuildSignedResponseQuery(string xml, string? relayState, X509Certificate2 signingCertificate)Parameters
xmlstringrelayStatestringsigningCertificateX509Certificate2
Returns
Remarks
The twin of BuildSignedRequestQuery(string, string?, X509Certificate2), added in 0.70.0
because the service provider has a response to sign: the LogoutResponse answering an identity
provider's LogoutRequest.
BuildResponseQuery(string, string?) had existed since 0.60.0 without one, so the parameter name a signed
message could travel under was SAMLRequest and nothing else — the same rule applied to one of its
two halves that SamlRedirectSignature's own remarks record on the verifying side.
It shares Sign(string, X509Certificate2, string) with the request builder rather than repeating it, so the octet string, the algorithm and the signature encoding cannot come to differ between the two directions. A verifier reconstructs those bytes from the query alone and has no way to be lenient about which of the two wrote them.
BuildSignedResponseQuery(string, string?, X509Certificate2, string?)
The same, signed with the method named, or the one the key implies when it is null.
public static string BuildSignedResponseQuery(string xml, string? relayState, X509Certificate2 signingCertificate, string? signatureMethod)Parameters
xmlstringrelayStatestringsigningCertificateX509Certificate2signatureMethodstring
Returns
Decode(string)
Decodes a redirect-binding message value (already URL-decoded by the web layer).
public static string Decode(string encoded)Parameters
encodedstring
Returns
Decode(string, int)
The same, refusing to inflate past maxSize bytes; zero means no limit.
public static string Decode(string encoded, int maxSize)Parameters
Returns
Remarks
Duende 8.0.1's bound, measured: the inflate reads through a limit and stops at it, because a few kilobytes of DEFLATE expand to anything — a URL-sized request could be made to allocate gigabytes. Until 0.133.0 this read to the end whatever it found. Over the limit is an InvalidOperationException; data that is not DEFLATE is an InvalidDataException.
Encode(string)
Encodes a SAML message for the redirect binding (raw DEFLATE + base64). URL-encode the result for a query string.
public static string Encode(string xml)Parameters
xmlstring