Class SamlServiceProviderValidation

Namespace

Fdyay.IdentityServer.Saml.Idp

Assembly

Fdyay.IdentityServer.Saml.dll

What makes a registered service provider unusable, checked where the registration is read.

public static class SamlServiceProviderValidation

Inheritance

object

SamlServiceProviderValidation

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

The reply address is the whole reason this exists. A SAML response carries a signed assertion, which is a bearer credential for whoever holds it, and the registration is the only thing that decides where it is delivered — an AuthnRequest may name a reply address but the validator requires it to equal the registered one, so the registration has the last word.

Until 0.71.0 the only check that address met was IdentityServerOptions.Validation.IsAllowedRedirectTarget, which is a scheme deny-list — javascript:, data: and five more — and which answers true for the empty string, for a relative path, and for http://. So a registration could send a signed assertion over plaintext to a non-loopback host, and nothing said so. That deny-list stays where it is and remains the backstop for a scheme; what it was never asked is whether the address is a place a partner could be.

Loopback is allowed plaintext unconditionally, because a partner running on the developer's own machine is the case https cannot be asked of, and because a credential that does not leave the host is not on a wire. Everything else is refused unless a host sets SamlOptions.RequireHttpsServiceProviderUrls to false, which is the escape for a deployment terminating TLS somewhere this server cannot see.

Methods

FindProblem(SamlServiceProvider, bool)

The first problem with this registration, or null when there is none.

public static string? FindProblem(SamlServiceProvider serviceProvider, bool requireHttps)

Parameters

serviceProvider SamlServiceProvider

requireHttps bool

Returns

string

Remarks

The first rather than all of them: this is read on the way to refusing the registration, and a caller that has one reason to refuse does not need the rest. A host fixing several gets the next on the next request.