Table of Contents

Class SamlAuthnRequestValidator

Namespace
Fdyay.IdentityServer.Saml.Idp
Assembly
Fdyay.IdentityServer.Saml.dll

Validates SP-initiated AuthnRequests against the registered service providers.

public class SamlAuthnRequestValidator : IAuthnRequestValidator
Inheritance
SamlAuthnRequestValidator
Implements
Inherited Members

Constructors

SamlAuthnRequestValidator(ISamlServiceProviderStore, IOptions<SamlOptions>?, TimeProvider?, IServerUrls?, ISamlResourceResolver?) 

public SamlAuthnRequestValidator(ISamlServiceProviderStore serviceProviders, IOptions<SamlOptions>? options = null, TimeProvider? time = null, IServerUrls? urls = null, ISamlResourceResolver? resources = null)

Parameters

serviceProviders ISamlServiceProviderStore

The registry the request's issuer is looked up in.

options IOptions<SamlOptions>

The SAML options; the defaults when null.

time TimeProvider

The clock a request's age is read against; the system's when null.

urls IServerUrls

Where this server is, which a request's Destination must name; not checked when null.

resources ISamlResourceResolver

What the provider may be issued as attributes; when null nothing is resolved, and the assertion carries only what the profile service adds as SamlAttributes.

Methods

ValidateAssertionConsumerService(SamlAuthnRequest, SamlServiceProvider)

The assertion consumer service the request is answered at, or why the request is refused. Duende's ValidateAcsUrl, measured.

protected virtual (IndexedEndpoint? Endpoint, SamlAuthnRequestValidationResult? Refusal) ValidateAssertionConsumerService(SamlAuthnRequest request, SamlServiceProvider serviceProvider)

Parameters

request SamlAuthnRequest
serviceProvider SamlServiceProvider

Returns

(IndexedEndpoint Endpoint, SamlAuthnRequestValidationResult Refusal)

Remarks

A URL and an index together are refused. A URL must be absolute and, as AbsoluteUri spells it, be one of the provider's endpoints — narrowed to the request's ProtocolBinding when one there matches, and the default among several else the first. An index must be one of the provider's. Neither is answered at the default endpoint, else the first. Until 0.143.0 a provider had one endpoint and the URL was compared as written; an index was not read.

ValidateAsync(string, SamlRedirectSignature?, DateTimeOffset?, CancellationToken) 

public virtual Task<SamlAuthnRequestValidationResult> ValidateAsync(string xml, SamlRedirectSignature? redirectSignature = null, DateTimeOffset? receivedAt = null, CancellationToken cancellationToken = default)

Parameters

xml string

The decoded AuthnRequest.

redirectSignature SamlRedirectSignature

The detached signature material the request arrived with under the HTTP-Redirect binding, or null when it arrived over a binding that carries its signature in the message. It is passed in rather than read from the request because the raw query string lives at the endpoint, not here.

receivedAt DateTimeOffset?

When this server received it, for a request validated again after the user signed in; now when null. Its age is measured to then, so the time the user spent at the login page does not expire it.

cancellationToken CancellationToken

Cancels the service provider lookup.

Returns

Task<SamlAuthnRequestValidationResult>

ValidateDestination(SamlAuthnRequest, bool)

Refuses a request addressed to another server. Duende's ValidateDestination, measured.

protected virtual string? ValidateDestination(SamlAuthnRequest request, bool signatureVerified)

Parameters

request SamlAuthnRequest
signatureVerified bool

Returns

string

Remarks

When it names one, it must be this server's single sign-on URL, compared ignoring case; a signed request must name one, an unsigned one need not. Not checked when the validator was given no IServerUrls to know where it is. Until 0.133.0 the destination was never read.

ValidateIssueInstant(SamlAuthnRequest, SamlServiceProvider, DateTimeOffset)

Refuses a request too old, or from too far ahead. Duende's ValidateIssueInstant, measured.

protected virtual string? ValidateIssueInstant(SamlAuthnRequest request, SamlServiceProvider serviceProvider, DateTimeOffset now)

Parameters

request SamlAuthnRequest
serviceProvider SamlServiceProvider
now DateTimeOffset

Returns

string

Remarks

Ahead of now by more than the clock skew, or older than the maximum age — the provider's own of each, else ClockSkew and DefaultRequestMaxAge. The skew is not added to the age, as Duende does not add it. Until 0.133.0 a request of any age was answered.

ValidateNameIdFormat(SamlAuthnRequest, SamlServiceProvider)

Refuses a request for a NameID format this server does not issue. Duende's ValidateNameIdFormat, measured.

protected virtual string? ValidateNameIdFormat(SamlAuthnRequest request, SamlServiceProvider serviceProvider)

Parameters

request SamlAuthnRequest
serviceProvider SamlServiceProvider

Returns

string

Remarks

The format asked for, else the provider's DefaultNameIdFormat, must be one of SupportedNameIdFormats, compared exactly; a request asking for none from a provider with no default passes. Until 0.134.0 the request could ask only for its provider's one format, and was asked after the user had signed in rather than before.

ValidateResourcesAsync(SamlServiceProvider, CancellationToken)

Resolves the claim types the provider may be issued, refusing a provider whose registration cannot be served. Duende's ValidateResourcesAsync, measured: the last check.

protected virtual Task<SamlResourceResolutionResult?> ValidateResourcesAsync(SamlServiceProvider serviceProvider, CancellationToken cancellationToken)

Parameters

serviceProvider SamlServiceProvider
cancellationToken CancellationToken

Returns

Task<SamlResourceResolutionResult>

The resolution, or null when this validator was given no ISamlResourceResolver.

ValidateSignatureRequired(SamlServiceProvider, bool)

Refuses an unsigned request from a provider that must sign. Duende's ValidateSignatureTrust.

protected virtual string? ValidateSignatureRequired(SamlServiceProvider serviceProvider, bool signatureVerified)

Parameters

serviceProvider SamlServiceProvider
signatureVerified bool

Returns

string

Remarks

Required when the provider says so, and otherwise when WantAuthnRequestsSigned does — true by default, as Duende's is. A provider with no certificate cannot sign, so it is refused unless it opts out with RequireSignedAuthnRequests = false. Until 0.133.0 any provider without a certificate was answered unsigned.