Class SamlSignature

Namespace

Fdyay.IdentityServer.Saml.Xml

Assembly

Fdyay.IdentityServer.Saml.dll

Enveloped XML-DSig signing and verification for SAML elements, hardened against signature-wrapping (XSW) and transform-substitution attacks.

public static class SamlSignature

Inheritance

object

SamlSignature

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Methods

SignElement(XmlElement, X509Certificate2)

Signs a SAML element in place with an enveloped signature.

public static void SignElement(XmlElement element, X509Certificate2 certificate)

Parameters

element XmlElement

certificate X509Certificate2

Remarks

The element must carry an ID attribute; the signature is inserted after Issuer. The algorithm follows the certificate's key — RSA-SHA256, or ECDSA with the hash its curve pairs with — rather than being fixed, so a host configured with an EC certificate signs with it instead of being told its certificate has no RSA private key.

SignElement(XmlElement, X509Certificate2, string?)

The same, signed with the method named, or the one the key implies when it is null.

public static void SignElement(XmlElement element, X509Certificate2 certificate, string? signatureMethod)

Parameters

element XmlElement

certificate X509Certificate2

signatureMethod string

VerifyElement(XmlElement, AsymmetricAlgorithm)

Verifies that element carries a single enveloped signature, made with the expected key, that covers exactly this element. Returns false on any structural or crypto failure.

public static bool VerifyElement(XmlElement element, AsymmetricAlgorithm expectedPublicKey)

Parameters

element XmlElement

expectedPublicKey AsymmetricAlgorithm

Returns

bool