Table of Contents

Class SamlResponseGenerator

Namespace
Fdyay.IdentityServer.Saml.Idp
Assembly
Fdyay.IdentityServer.Saml.dll

Builds signed SAML responses for authenticated subjects (IdP role).

public sealed class SamlResponseGenerator
Inheritance
SamlResponseGenerator
Inherited Members

Remarks

Constructed over an ISamlSigningService, as the endpoints are, it signs with whatever certificate the service answers at the time — this server's current key, so a rotation reaches the next response — and only the asynchronous methods can ask it. Constructed over a certificate, it signs with that one, by either.

Constructors

SamlResponseGenerator(ISamlSigningService, SamlOptions, TimeProvider)

A generator that asks signingService for the certificate each time it signs.

public SamlResponseGenerator(ISamlSigningService signingService, SamlOptions options, TimeProvider time)

Parameters

signingService ISamlSigningService
options SamlOptions
time TimeProvider

SamlResponseGenerator(X509Certificate2, SamlOptions, TimeProvider)

A generator that signs with signingCertificate, by either the synchronous or the asynchronous methods.

public SamlResponseGenerator(X509Certificate2 signingCertificate, SamlOptions options, TimeProvider time)

Parameters

signingCertificate X509Certificate2

The certificate every response is signed with.

options SamlOptions

The SAML options: default signing behaviour and assertion lifetime.

time TimeProvider

The clock the response's instants and the assertion's lifetime are read from.

Exceptions

ArgumentNullException

Any argument is null.

Methods

CreateSignedFailureResponse(string, SamlServiceProvider, string?, string, string?, string?)

Creates a signed samlp:Response that carries a status and no assertion.

public string CreateSignedFailureResponse(string issuer, SamlServiceProvider serviceProvider, string? inResponseTo, string code, string? subCode = null, string? assertionConsumerServiceUrl = null)

Parameters

issuer string
serviceProvider SamlServiceProvider
inResponseTo string
code string
subCode string
assertionConsumerServiceUrl string

Returns

string

Remarks

The Response element is signed here, where a successful response signs the assertion inside it. There is no assertion to sign, and leaving the message unsigned would let anyone able to reach the service provider's reply address assert a failure on this server's behalf — for NoPassive in particular, "nobody is signed in" is a claim a relying party acts on.

So it is signed whatever the provider's SigningBehavior, unless that is DoNotSign. Duende signs a failure only under SignResponse, which its default is not. Addressed to assertionConsumerServiceUrl, else the provider's default endpoint.

inResponseTo is null, since 0.151.0, for an IdP-initiated sign-on the user declined: there was no request, and the attribute is left out, as on that door's assertions.

CreateSignedFailureResponseAsync(string, SamlServiceProvider, string?, string, string?, string?, CancellationToken)

CreateSignedFailureResponse(string, SamlServiceProvider, string?, string, string?, string?), signed with the certificate the signing service answers now, or the one this generator was constructed with.

public Task<string> CreateSignedFailureResponseAsync(string issuer, SamlServiceProvider serviceProvider, string? inResponseTo, string code, string? subCode, string? assertionConsumerServiceUrl, CancellationToken ct)

Parameters

issuer string
serviceProvider SamlServiceProvider
inResponseTo string
code string
subCode string
assertionConsumerServiceUrl string
ct CancellationToken

Returns

Task<string>

CreateSignedResponse(string, SamlServiceProvider, SamlSubjectContext, string?, string?)

Creates a signed samlp:Response for the given SP and subject.

public string CreateSignedResponse(string issuer, SamlServiceProvider serviceProvider, SamlSubjectContext subject, string? inResponseTo, string? assertionConsumerServiceUrl = null)

Parameters

issuer string
serviceProvider SamlServiceProvider
subject SamlSubjectContext
inResponseTo string
assertionConsumerServiceUrl string

Returns

string

Remarks

inResponseTo is null for an unsolicited response — the IdP-initiated half of the Web SSO profile, where no request was made to answer. §4.1.5 requires the attribute to be absent there rather than empty, which is what the writer does with a null: it emits no attribute at either of the two places one would appear.

Since 0.143.0, Duende's, measured: what is signed is the provider's SigningBehavior, else DefaultSigningBehavior — the assertion; the assertion lasts the provider's AssertionLifetime, else AssertionLifetime; and it is addressed to assertionConsumerServiceUrl, the endpoint the request chose, else the provider's default.

CreateSignedResponseAsync(string, SamlServiceProvider, SamlSubjectContext, string?, string?, CancellationToken)

CreateSignedResponse(string, SamlServiceProvider, SamlSubjectContext, string?, string?), signed with the certificate the signing service answers now, or the one this generator was constructed with.

public Task<string> CreateSignedResponseAsync(string issuer, SamlServiceProvider serviceProvider, SamlSubjectContext subject, string? inResponseTo, string? assertionConsumerServiceUrl, CancellationToken ct)

Parameters

issuer string
serviceProvider SamlServiceProvider
subject SamlSubjectContext
inResponseTo string
assertionConsumerServiceUrl string
ct CancellationToken

Returns

Task<string>