Class SamlResponseValidationContext

Namespace

Fdyay.IdentityServer.Saml.Validation

Assembly

Fdyay.IdentityServer.Saml.dll

What the caller must assert about an inbound SAML response before it can be trusted.

public sealed class SamlResponseValidationContext

Inheritance

object

SamlResponseValidationContext

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Properties

DecryptionKey

Our private key for an EncryptedAssertion, or null when we publish no encryption key.

public RSA? DecryptionKey { get; init; }

Property Value

RSA

Remarks

Held by the caller, not owned here — the validator neither disposes it nor keeps it past the call.

ExpectedAudience

Our entity ID, expected in the assertion's AudienceRestriction.

public required string ExpectedAudience { get; init; }

Property Value

string

ExpectedInResponseTo

The ID of the AuthnRequest we issued, or null when we issued none.

public string? ExpectedInResponseTo { get; init; }

Property Value

string

Remarks

Nullable because "no request was made" is a state a receiver can be in — the unsolicited half of the Web SSO profile — and it is not the same state as "do not check". A null expectation means the response must name no request at all: that is what stops a captured solicited assertion being replayed as an unsolicited one, and it is why this is a nullable expectation rather than a check the caller can skip.

ExpectedIssuer

The expected Issuer (the upstream IdP entity ID).

public required string ExpectedIssuer { get; init; }

Property Value

string

ExpectedRecipient

The ACS URL the assertion must name as its Recipient.

public required string ExpectedRecipient { get; init; }

Property Value

string

IdpSigningKey

The upstream IdP's trusted public signing key (from its metadata/configuration).

public required AsymmetricAlgorithm IdpSigningKey { get; init; }

Property Value

AsymmetricAlgorithm

RequireEncryptedAssertion

Whether an assertion that arrives unencrypted is refused.

public bool RequireEncryptedAssertion { get; init; }

Property Value

bool

Remarks

Off by default, because an IdP that does not encrypt is the common case. On, it closes the downgrade: accepting either shape lets whoever is on the path strip the encryption and be believed.