Table of Contents

Class SamlMetadataWriter

Namespace
Fdyay.IdentityServer.Saml.Metadata
Assembly
Fdyay.IdentityServer.Saml.dll

Serializes SAML 2.0 metadata documents.

public static class SamlMetadataWriter
Inheritance
SamlMetadataWriter
Inherited Members

Methods

WriteIdpMetadata(string, string, string, IEnumerable<X509Certificate2>, string?, bool, IEnumerable<string>?, IEnumerable<string>?, IEnumerable<string>?)

Builds an IdP EntityDescriptor advertising the SSO endpoints and every signing certificate, in order.

public static XmlDocument WriteIdpMetadata(string entityId, string ssoRedirectUrl, string ssoPostUrl, IEnumerable<X509Certificate2> signingCertificates, string? singleLogoutUrl = null, bool wantAuthnRequestsSigned = false, IEnumerable<string>? nameIdFormats = null, IEnumerable<string>? singleSignOnBindings = null, IEnumerable<string>? singleLogoutBindings = null)

Parameters

entityId string

The identity provider's entity id, written as the descriptor's entityID.

ssoRedirectUrl string

The sign-on service's address for the HTTP-Redirect binding.

ssoPostUrl string

The sign-on service's address for the HTTP-POST binding.

signingCertificates IEnumerable<X509Certificate2>

The certificates whose public keys verify this server's signatures, written in the order given.

singleLogoutUrl string

The logout service's address; no logout service is advertised when null or empty.

wantAuthnRequestsSigned bool

Whether to tell service providers their requests must be signed; the attribute is written only when true.

nameIdFormats IEnumerable<string>

The name identifier formats a request may ask for, written in order; none when null.

singleSignOnBindings IEnumerable<string>

The bindings the sign-on service is advertised with, of HTTP-Redirect and HTTP-POST; both when null. Duende's SingleSignOnServiceBindings; a binding this server does not serve is not written.

singleLogoutBindings IEnumerable<string>

The same, for the logout service.

Returns

XmlDocument

Remarks

Several while keys overlap — one per signing algorithm, or the configured certificate and the next — so a partner holds the key that signs before it signs. Since 0.144.0, for SamlMetadataResponseGenerator.

WriteIdpMetadata(string, string, string, X509Certificate2, string?, bool, IEnumerable<string>?, IEnumerable<string>?, IEnumerable<string>?)

Builds an IdP EntityDescriptor advertising the SSO endpoints and signing certificate.

public static XmlDocument WriteIdpMetadata(string entityId, string ssoRedirectUrl, string ssoPostUrl, X509Certificate2 signingCertificate, string? singleLogoutUrl = null, bool wantAuthnRequestsSigned = false, IEnumerable<string>? nameIdFormats = null, IEnumerable<string>? singleSignOnBindings = null, IEnumerable<string>? singleLogoutBindings = null)

Parameters

entityId string

The identity provider's entity id, written as the descriptor's entityID.

ssoRedirectUrl string

The sign-on service's address for the HTTP-Redirect binding.

ssoPostUrl string

The sign-on service's address for the HTTP-POST binding.

signingCertificate X509Certificate2

The certificate whose public key verifies this server's signatures.

singleLogoutUrl string

The logout service's address; no logout service is advertised when null or empty.

wantAuthnRequestsSigned bool

Whether to tell service providers their requests must be signed; the attribute is written only when true.

nameIdFormats IEnumerable<string>

The name identifier formats a request may ask for, written in order; none when null.

singleSignOnBindings IEnumerable<string>

The bindings the sign-on service is advertised with, of HTTP-Redirect and HTTP-POST; both when null. Duende's SingleSignOnServiceBindings; a binding this server does not serve is not written.

singleLogoutBindings IEnumerable<string>

The same, for the logout service.

Returns

XmlDocument

WriteSpMetadata(string, string, X509Certificate2?, string?, X509Certificate2?)

Builds an SP EntityDescriptor advertising the reply address and the keys it holds.

public static XmlDocument WriteSpMetadata(string entityId, string assertionConsumerServiceUrl, X509Certificate2? encryptionCertificate = null, string? singleLogoutUrl = null, X509Certificate2? signingCertificate = null)

Parameters

entityId string
assertionConsumerServiceUrl string
encryptionCertificate X509Certificate2
singleLogoutUrl string
signingCertificate X509Certificate2

Returns

XmlDocument

Remarks

Every claim here is one this server actually keeps. WantAssertionsSigned is true because the validator refuses an unsigned assertion; AuthnRequestsSigned follows signingCertificate, because a strict identity provider rejects a request whose metadata promised a signature. Metadata that overclaims fails at the partner's end and looks like our bug.

The flag and the published signing key are one fact told twice and are written from the same argument for that reason. AuthnRequestsSigned="true" with no key tells a partner to expect a signature it has no way to verify; a published signing key with the flag false invites it to ignore one it could have checked. Before 0.70.0 there was no key to write either from, so the flag was the constant "false".