Class SamlRedirectSignature

Namespace

Fdyay.IdentityServer.Saml.Bindings

Assembly

Fdyay.IdentityServer.Saml.dll

The detached signature a service provider delivers on the query string under the HTTP-Redirect binding (SAML 2.0 Bindings §3.4.4.1).

public sealed class SamlRedirectSignature

Inheritance

object

SamlRedirectSignature

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

The redirect binding DEFLATEs the message into the URL, where an enveloped XML-DSig signature cannot survive, so the signature covers the query string itself: the message parameter — SAMLRequest or SAMLResponse, whichever the sender used — then RelayState (present only when the sender sent one) and SigAlg, concatenated in exactly that order — not the order they happened to arrive in.

The values are taken as raw substrings of the query string, still URL-encoded. Re-encoding a decoded value would not reliably reproduce the sender's bytes: + versus %20, the case of the hex digits, and which characters were escaped at all are the sender's choice.

Properties

Algorithm

The URL-decoded SigAlg value the sender named, or empty when it sent none.

public string Algorithm { get; }

Property Value

string

Methods

Read(string?)

Reads the detached signature material out of a raw query string — the value of HttpRequest.QueryString, with or without its leading ?.

public static SamlRedirectSignature? Read(string? rawQueryString)

Parameters

rawQueryString string

Returns

SamlRedirectSignature

null when the query carries no Signature parameter — an unsigned request, which the caller decides the fate of. A query that carries a Signature always yields an instance, even when the rest of the material is missing, so that a claim to be signed is always answered by Verify(AsymmetricAlgorithm) rather than silently treated as unsigned.

Remarks

Since 0.178.0 a query that carries both SAMLRequest and SAMLResponse, or any of the signed parameters twice, never verifies: until then the signature was checked over the first message and the first copy of each value, while an endpoint acted on whichever message it reads, joined across copies — so a message the sender signed vouched for one it never sent. Duende 8.0.1's HttpRedirectBinding refuses the same queries, measured. An endpoint that knows which message it consumes says so with Read(string?, string).

Read(string?, string)

Reads the detached signature over messageParameter — SAMLRequest or SAMLResponse, the message the caller is about to act on (SAML Bindings §3.4.4.1).

public static SamlRedirectSignature? Read(string? rawQueryString, string messageParameter)

Parameters

rawQueryString string

The raw query string, with or without its leading ?.

messageParameter string

The parameter the caller decodes and acts on.

Returns

SamlRedirectSignature

null when the query carries no Signature; otherwise an instance whose Verify(AsymmetricAlgorithm) is false unless the query names that message, and only that one, exactly once, with no signed parameter repeated.

Remarks

Since 0.178.0.

Exceptions

ArgumentException

messageParameter is neither SAMLRequest nor SAMLResponse.

Verify(AsymmetricAlgorithm)

Verifies the signature against the sender's public key. Returns false for any failure — a bad signature is an ordinary outcome here, not an exceptional one.

public bool Verify(AsymmetricAlgorithm publicKey)

Parameters

publicKey AsymmetricAlgorithm

Returns

bool