Class SamlResponseValidator

Namespace

Fdyay.IdentityServer.Saml.Validation

Assembly

Fdyay.IdentityServer.Saml.dll

Validates inbound SAML responses: signature, status, and all subject/condition constraints.

public sealed class SamlResponseValidator

Inheritance

object

SamlResponseValidator

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

SamlResponseValidator(SamlOptions, TimeProvider)

Creates the validator.

public SamlResponseValidator(SamlOptions options, TimeProvider time)

Parameters

options SamlOptions

The SAML options, whose ClockSkew the time checks allow.

time TimeProvider

The clock the time checks read.

Exceptions

ArgumentNullException

Either argument is null.

Methods

Validate(string, SamlResponseValidationContext)

Validates a decoded samlp:Response against what context expects.

public SamlValidationResult Validate(string xml, SamlResponseValidationContext context)

Parameters

xml string

The response XML, already decoded from its binding.

context SamlResponseValidationContext

The expected issuer, audience, recipient and request id, and the keys to verify and decrypt with.

Returns

SamlValidationResult

A success carrying the response, or a failure naming the first check it failed: size, decryption, form, version, status, assertion presence, signature, issuer, time window, audience, InResponseTo, destination, bearer confirmation, recipient, or subject confirmation expiry.

Remarks

Since 0.178.0 the bearer requirements of SAML Profiles §4.1.4.2 are requirements rather than checks made when the assertion happens to carry the value: an AudienceRestriction naming ExpectedAudience (no_audience_restriction), a bearer SubjectConfirmation (no_bearer_confirmation) whose data names ExpectedRecipient (no_recipient) and carries NotOnOrAfter (no_subject_confirmation_expiry); a response Destination, when present, must be the same address (destination_mismatch); and a document longer than MaxMessageSize is refused (message_too_large).

Exceptions

ArgumentException

xml is null or empty.

ArgumentNullException

context is null.