Adding "RequestedAuthnContext" to samlp:AuthnRequest

SAML for ASP.NET
1
SyntaxEditor Code SnippetHi there ,
SyntaxEditor Code SnippetI trying to add new section to samlp:AuthnRequest , as below :
<samlp:AuthnRequest..........
<samlp:RequestedAuthnContext Comparison="exact">
 <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef> </samlp:RequestedAuthnContext>
</samlp:AuthnRequest>

I already used SP-Initiated , SAML2ServiceProvider samples.
Any help will be appreciated.
Thanks
Faris
2

Hi Faris
This can be specified through the PartnerIdentityProvider section of your saml.config.


<PartnerIdentityProvider
Name=“XXXX”
AuthnContextComparison=“exact”
AuthnContext=“urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport”



3
[quote]
ComponentSpace - 12/21/2018
Hi Faris
This can be specified through the PartnerIdentityProvider section of your saml.config.


<PartnerIdentityProvider
Name="XXXX"
AuthnContextComparison="exact"
AuthnContext="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"



[/quote]

Thanks for your reply,
I used the Lowlevel project. Is there any way to add the above section programmatically.??

If not possible, Please advice how to do it using saml.config step by step, since i am new to componentSpace.
Faris

4

You are better to use the SAML high-level API as it’s easier to use and is configuration driven.
The low-level API is available for less common use cases.
The Examples Guide walks you through the example projects that call the high-level API and include SAML configuration files.
https://www.componentspace.com/Forums/9351/Examples-Guide
The Configuration Guide provides details of SAML configuration.
https://www.componentspace.com/Forums/9350/Configuration-Guide

5
[quote]
ComponentSpace - 12/21/2018
You are better to use the SAML high-level API as it's easier to use and is configuration driven.
The low-level API is available for less common use cases.
The Examples Guide walks you through the example projects that call the high-level API and include SAML configuration files.
https://www.componentspace.com/Forums/9351/Examples-Guide
The Configuration Guide provides details of SAML configuration.
https://www.componentspace.com/Forums/9350/Configuration-Guide

[/quote]

Thanks for your reply.
Actually , I need to add custom settings to generated Authnrequest as below:
1- add deflate + base64 encoding.
2- add URLEncoding
How can I do it using high level asp.net webforms example.
Faris
6

These are done for you when you call SAMLServiceProvider.InitiateSSO.

7
[quote]
ComponentSpace - 12/21/2018
These are done for you when you call SAMLServiceProvider.InitiateSSO.
[/quote]

thanks for your reply,
I am trying to call third party Identity Provider. below sample message for my actual post call :

"..............k09PC9YNTA5Q2VydGlmaWNhdGU+PC9YNTA5RGF0YT48L0tleUluZm8+PC9TaWduYXR1cmU+PHNhbWxwOk5hbWVJRFBvbGljeSBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjEuMTpuYW1laWQtZm9ybWF0OnVuc3BlY2lmaWVkIiBBbGxvd0NyZWF0ZT0idHJ1ZSIgLz48c2FtbHA6UmVxdWVzdGVkQXV0aG5Db250ZXh0IENvbXBhcmlzb249ImV4YWN0Ij48c2FtbDpBdXRobkNvbnRleHRDbGFzc1JlZiB4bWxuczpzYW1sPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj51cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YWM6Y2xhc3NlczpQYXNzd29yZFByb3RlY3RlZFRyYW5zcG9ydDwvc2FtbDpBdXRobkNvbnRleHRDbGFzc1JlZj48L3NhbWxwOlJlcXVlc3RlZEF1dGhuQ29udGV4dD48L3NhbWxwOkF1dGhuUmVxdWVzdD4="

That message above contains special characters such as : + =
I think its not URL Encoded. Please advice how to achieve URL Encoding .

I am using : SAMLServiceProvider.InitiateSSO with high level ASP.NET Web forms sample project.

Thanks
Faris


8

The URL encoding occurs as part of the call to SAMLServiceProvider.InitiateSSO.
No further action is required.
I’m not sure how you captured the sample but if you use something like browser developer tools to take a look at the raw URL you’ll see it’s properly encoded.

9
[quote]
ComponentSpace - 12/23/2018
The URL encoding occurs as part of the call to SAMLServiceProvider.InitiateSSO.
No further action is required.
I'm not sure how you captured the sample but if you use something like browser developer tools to take a look at the raw URL you'll see it's properly encoded.
[/quote]

Yes , I captured it using browser developer tools. Any advice for above issue will be appreciated.
At this time ,I need your help in order to finalize the testing SSO using ComponentSpace .
So , In order to facilitate my issue , can you please download my project using this link. and open it using vs 2017 and try it from your browser .
I used HTTP POST.

Thanks for your help
Faris
10

Below is a capture of a URL using Chrome’s dev tools.

https://localhost:44390/SAML/SSOService.aspx?SAMLRequest=fZLNbsIwEIRfJfI9JCFJCRYgUWhVJFoiQnvopTLOUiw5dup1KH375gcqeoDramfm86xHyApZ0mll92oNXxWgdRbzMfnwhwnELM5dHoDvRvk2dId5DO42GARwByEPk5g4b2BQaDUm%2FZ5PnAViBQuFlilbj%2FwgcYO%2B2482fkL9gEZxL%2FEH78SZ1ylCMdsq99aWSD1Pas7kXqOlURQOfS%2BbPi%2B9LFtlYA6CQ49heSTOozYcWtox2TGJ0KSmDFEc4G%2BSGm011%2FJeqFyozzGpjKKaoUCqWAFILaeNPa2p6bZbQvq02aRuuso2xJkigmnwZlphVYA5Qbyul1eAw6QDvqY84R8LqZC2nd%2BmKk9PIJNRs03bas2F%2FracnTHI5Iz7cGRFKeHEU1d0EDmYkXdh32WV9KX2W8xTLQX%2FaRovmL0eF%2FSCdiJyd9eu0kphCVzsBOR1lVLq75kBZuv7WFPV5%2FEmXer%2Fbzf5BQ%3D%3D&RelayState=%2F&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=U2igM2N05qVsQAcqVUhgs%2Fvk%2BM1jLb1NrJEBmmFV%2BX7D9dCOvpWhf96V5Jr%2B2uM5Uv%2BckyIalBbIh0i6lVN%2BgR9BeBN%2BFD4d%2B0Zn3gJeIROB8EhAMoBmpBjGEmcTMu10DcDcNnLxI14bW%2FaQJnbaH4pB1abmXVcztwEa0pA8fTbSbfyg1UHGv8ToMxjgqWacQeKvJtQaoLIO47JUpCWULyHqVO83FrlHIaNsA5S6IYQh6KgEPwvnA7Ny4tDA6ceyw3g7PZRTU7OvuQx%2B%2Fql5gx06Iyw%2BE%2BdqS389DkKpMv6cGFHagag16fu5hrBpF9mN0lWXuHz%2BQILMpKEbnOlClw%3D%3D

The SAML message is encoded correctly.
I can assure you that there are no issues with the encoding of SAML messages by our product.
Have you tested with the third party identity provider?
If so, and you’re seeing an error, please provide the details.

11
[quote]
ComponentSpace - 12/24/2018
Below is a capture of a URL using Chrome's dev tools.

https://localhost:44390/SAML/SSOService.aspx?SAMLRequest=fZLNbsIwEIRfJfI9JCFJCRYgUWhVJFoiQnvopTLOUiw5dup1KH375gcqeoDramfm86xHyApZ0mll92oNXxWgdRbzMfnwhwnELM5dHoDvRvk2dId5DO42GARwByEPk5g4b2BQaDUm%2FZ5PnAViBQuFlilbj%2FwgcYO%2B2482fkL9gEZxL%2FEH78SZ1ylCMdsq99aWSD1Pas7kXqOlURQOfS%2BbPi%2B9LFtlYA6CQ49heSTOozYcWtox2TGJ0KSmDFEc4G%2BSGm011%2FJeqFyozzGpjKKaoUCqWAFILaeNPa2p6bZbQvq02aRuuso2xJkigmnwZlphVYA5Qbyul1eAw6QDvqY84R8LqZC2nd%2BmKk9PIJNRs03bas2F%2FracnTHI5Iz7cGRFKeHEU1d0EDmYkXdh32WV9KX2W8xTLQX%2FaRovmL0eF%2FSCdiJyd9eu0kphCVzsBOR1lVLq75kBZuv7WFPV5%2FEmXer%2Fbzf5BQ%3D%3D&RelayState=%2F&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=U2igM2N05qVsQAcqVUhgs%2Fvk%2BM1jLb1NrJEBmmFV%2BX7D9dCOvpWhf96V5Jr%2B2uM5Uv%2BckyIalBbIh0i6lVN%2BgR9BeBN%2BFD4d%2B0Zn3gJeIROB8EhAMoBmpBjGEmcTMu10DcDcNnLxI14bW%2FaQJnbaH4pB1abmXVcztwEa0pA8fTbSbfyg1UHGv8ToMxjgqWacQeKvJtQaoLIO47JUpCWULyHqVO83FrlHIaNsA5S6IYQh6KgEPwvnA7Ny4tDA6ceyw3g7PZRTU7OvuQx%2B%2Fql5gx06Iyw%2BE%2BdqS389DkKpMv6cGFHagag16fu5hrBpF9mN0lWXuHz%2BQILMpKEbnOlClw%3D%3D

The SAML message is encoded correctly.
I can assure you that there are no issues with the encoding of SAML messages by our product.
Have you tested with the third party identity provider?
If so, and you're seeing an error, please provide the details.
[/quote]

Thanks for your reply.
I did not use HTTP-Redirect .. my code is using HTTP-Post.
If you run my sample project in your machine and detect the chrome developer tools. and check the Form Data Raw .
Below is a part for that message :
.....ZYTBwek09PC9YNTA5Q2VydGlmaWNhdGU+PC9YNTA5RGF0YT48L0tleUluZm8+PC9TaWduYXR1cmU+PHNhbWxwOk5hbWVJRFBvbGljeSBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjEuMTpuYW1laWQtZm9ybWF0OnVuc3BlY2lmaWVkIiBBbGxvd0NyZWF0ZT0idHJ1ZSIgLz48c2FtbHA6UmVxdWVzdGVkQXV0aG5Db250ZXh0IENvbXBhcmlzb249ImV4YWN0Ij48c2FtbDpBdXRobkNvbnRleHRDbGFzc1JlZiB4bWxuczpzYW1sPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj51cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YWM6Y2xhc3NlczpQYXNzd29yZFByb3RlY3RlZFRyYW5zcG9ydDwvc2FtbDpBdXRobkNvbnRleHRDbGFzc1JlZj48L3NhbWxwOlJlcXVlc3RlZEF1dGhuQ29udGV4dD48L3NhbWxwOkF1dGhuUmVxdWVzdD4=

This is what i saw ( Plus sign with Equal sign ). Please advice.

waiting your reply.
Thanks
12

The HTTP-Post encoding is correct.
If you’re seeing plus and equal signs, the browser dev tools have decoded them.
For example, using Chrome dev tools, the default is to show the decoded (parsed) form data.
You can click the “view source” link to see the raw form data which is correctly encoded.

SAMLRequest=PHNhbWxwOkF1dGhuUmVxdWVzdCBJRD0iXzkwNjU3MjMyLTQzZjItNGE1Ny05M2Q4LWRlYWU4NTRiYzA5OSIgVmVyc2lvbj0iMi4wIiBJc3N1ZUluc3RhbnQ9IjIwMTgtMTItMjRUMDg6NTc6NDEuNjE0WiIgRGVzdGluYXRpb249Imh0dHBzOi8vbG9jYWxob3N0OjQ0MzkwL1NBTUwvU1NPU2VydmljZS5hc3B4IiBGb3JjZUF1dGhuPSJmYWxzZSIgSXNQYXNzaXZlPSJmYWxzZSIgUHJvdG9jb2xCaW5kaW5nPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YmluZGluZ3M6SFRUUC1QT1NUIiBBc3NlcnRpb25Db25zdW1lclNlcnZpY2VVUkw9Imh0dHBzOi8vbG9jYWxob3N0OjQ0MzM4L1NBTUwvQXNzZXJ0aW9uQ29uc3VtZXJTZXJ2aWNlLmFzcHgiIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiPjxzYW1sOklzc3VlciB4bWxuczpzYW1sPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj5odHRwczovL0V4YW1wbGVTZXJ2aWNlUHJvdmlkZXI8L3NhbWw6SXNzdWVyPjxTaWduYXR1cmUgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjxTaWduZWRJbmZvPjxDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIiAvPjxTaWduYXR1cmVNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGRzaWctbW9yZSNyc2Etc2hhMjU2IiAvPjxSZWZlcmVuY2UgVVJJPSIjXzkwNjU3MjMyLTQzZjItNGE1Ny05M2Q4LWRlYWU4NTRiYzA5OSI%2BPFRyYW5zZm9ybXM%2BPFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIiAvPjxUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiPjxJbmNsdXNpdmVOYW1lc3BhY2VzIFByZWZpeExpc3Q9IiNkZWZhdWx0IHNhbWxwIHNhbWwgZHMgeHMgeHNpIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIiAvPjwvVHJhbnNmb3JtPjwvVHJhbnNmb3Jtcz48RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjc2hhMjU2IiAvPjxEaWdlc3RWYWx1ZT5lYXRHNHVRY2tFQ2RvUlZTR2piMFdvMk4vZk1ZRFlZNWk4VEJBNG1ubWxrPTwvRGlnZXN0VmFsdWU%2BPC9SZWZlcmVuY2U%2BPC9TaWduZWRJbmZvPjxTaWduYXR1cmVWYWx1ZT5vc2lTQjh1dzFJMlVQRFN0Wi9UQndUYVBYRXhReE5QM0Y3Mi81ckd1a1JpVlhQN0xOSGd0UGp3azhKWFdYb0pwL29YaVFSYXoyNHRsbEVCb3ZJMGtKdFRjQlJya3gzL2orZllZR2wrYzZDd3FWaFlCS2FIQjkzTEU4R0QrRWNYUzhDNTYvbUZKZjJFRG1Tb3hTU3Z5VGpMd0txc0c1OFdkTnljTXFOcEE2amI3M1FTZERhcEFtZGVmWVBUMnJrVDZidktEZ1lRa1FGUmpsNFJ4V1g0Y3A1MlBIK2JrQURGTWdjeHhjUXIwMGMzOTdENm9TU0VudDN3ak5TZjJwakV2VFVUVUwrT2ZxczR1VDN0c0dwT2JFeFd6TEdUNGxCOXZmTzI0YzZYUzFZZzFuUDFhREIxUjUxQXZNeDg1bUxoVDNBNlliRkptQlB2eGRvVU5lSWYxc0E9PTwvU2lnbmF0dXJlVmFsdWU%2BPEtleUluZm8%2BPFg1MDlEYXRhPjxYNTA5Q2VydGlmaWNhdGU%2BTUlJQy9qQ0NBZWFnQXdJQkFnSVFDR2VoZmNudjZyNU15L2ZucmJmRGVqQU5CZ2txaGtpRzl3MEJBUXNGQURBVk1STXdFUVlEVlFRREV3cDNkM2N1YzNBdVkyOXRNQjRYRFRFek1URXlNakE0TWpNeU1Wb1hEVFE1TVRJek1URTBNREF3TUZvd0ZURVRNQkVHQTFVRUF4TUtkM2QzTG5Od0xtTnZiVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNUG0vZXc5amFHV3BRUzFDN0t0cHZnelY0blNPSUZQZ1J0L25sUllSK3BVV2RERWZTS215aksyOG5rUTFLS3VqUkpUbnZubVp5ZG1Vcm1FRnBWditnaUJpVWt2Q0pZM1B4Wi9FRFNzRjNSL096V2hrVXY1bmZBWFBucWtYOXgyMmI2K3ZVb2Y2V2lMR3lBVzZsT1lNQ1ZBRGpUU2w5cFNhVXRJYUFOZHg5bWFFUmNUOWVRYkdTbmppbTBXdXJGUllzOVpFOHR0RXJyTUg5K1N1NDI0NllEcU9QQWt6NkxhNGNISE1QUWRjRlFUNXAvY3VYQmZVMXZsMXRXZEJFZ0FZM3hIWVpFOHU1VFRKL3ZwOVV4eVUxTXdmZU8yZzlWRFJjb2tMUUhyajZ3Rnh0dnVmQStXdFVLWUpHVXUycC9xU3VhdzdlUzZVRmpVbjQ5YVZxZzlPYWNDQXdFQUFhTktNRWd3UmdZRFZSMEJCRDh3UFlBUTEvUzBpYmR2ZmRGa0o5VDlvSVBsdUtFWE1CVXhFekFSQmdOVkJBTVRDbmQzZHk1emNDNWpiMjJDRUFobm9YM0o3K3ErVE12MzU2MjN3M293RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUFIbG1Wb0FaVXQ2cGFlRnZ0UWJjL2lhSmUvRmhkK0pHMVUwanlqbEZEY0NuOGVyTGloRWJoYjNtRkJCTUYyNW9PNjdnZkExSkpYWnJtSHJ5M05sT1p1b3ZxUnFtOHY3d2c4bjBuUWExSFVXa1VDMlRCZ2ZnMUhFOC8ycm1TRjJQbmdpRWkxOFZPeFJEeHgwV1hNTlpYNkplYkoxa0NPQ3BUL3g3YXVwUzdUMUdySVBtREx4am5DOUJldDdwUnluZm9talAvNmlVMjEveE9JRjZ4QjlZZjFhL2tRYllkQVZ0MmhhWUtJZnZhRjN4c3ExWDV0Q1hjOWlqaEJNZ3lhb3FBK2JRSkQvbDNTOCt5Q21NeEVZWmpBVkxFa3lHbFU0VXdvMDFjS0VZYlhJRy9ZVnErNENhSVJ4SWZNdlYrajhnelRMSFRYSStwSEVNZk1oeVlhMHB6TT08L1g1MDlDZXJ0aWZpY2F0ZT48L1g1MDlEYXRhPjwvS2V5SW5mbz48L1NpZ25hdHVyZT48c2FtbHA6TmFtZUlEUG9saWN5IEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6dW5zcGVjaWZpZWQiIEFsbG93Q3JlYXRlPSJ0cnVlIiAvPjwvc2FtbHA6QXV0aG5SZXF1ZXN0Pg%3D%3D&RelayState=%2F

13
[quote]
ComponentSpace - 12/24/2018
Below is a capture of a URL using Chrome's dev tools.

https://localhost:44390/SAML/SSOService.aspx?SAMLRequest=fZLNbsIwEIRfJfI9JCFJCRYgUWhVJFoiQnvopTLOUiw5dup1KH375gcqeoDramfm86xHyApZ0mll92oNXxWgdRbzMfnwhwnELM5dHoDvRvk2dId5DO42GARwByEPk5g4b2BQaDUm%2FZ5PnAViBQuFlilbj%2FwgcYO%2B2482fkL9gEZxL%2FEH78SZ1ylCMdsq99aWSD1Pas7kXqOlURQOfS%2BbPi%2B9LFtlYA6CQ49heSTOozYcWtox2TGJ0KSmDFEc4G%2BSGm011%2FJeqFyozzGpjKKaoUCqWAFILaeNPa2p6bZbQvq02aRuuso2xJkigmnwZlphVYA5Qbyul1eAw6QDvqY84R8LqZC2nd%2BmKk9PIJNRs03bas2F%2FracnTHI5Iz7cGRFKeHEU1d0EDmYkXdh32WV9KX2W8xTLQX%2FaRovmL0eF%2FSCdiJyd9eu0kphCVzsBOR1lVLq75kBZuv7WFPV5%2FEmXer%2Fbzf5BQ%3D%3D&RelayState=%2F&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=U2igM2N05qVsQAcqVUhgs%2Fvk%2BM1jLb1NrJEBmmFV%2BX7D9dCOvpWhf96V5Jr%2B2uM5Uv%2BckyIalBbIh0i6lVN%2BgR9BeBN%2BFD4d%2B0Zn3gJeIROB8EhAMoBmpBjGEmcTMu10DcDcNnLxI14bW%2FaQJnbaH4pB1abmXVcztwEa0pA8fTbSbfyg1UHGv8ToMxjgqWacQeKvJtQaoLIO47JUpCWULyHqVO83FrlHIaNsA5S6IYQh6KgEPwvnA7Ny4tDA6ceyw3g7PZRTU7OvuQx%2B%2Fql5gx06Iyw%2BE%2BdqS389DkKpMv6cGFHagag16fu5hrBpF9mN0lWXuHz%2BQILMpKEbnOlClw%3D%3D

The SAML message is encoded correctly.
I can assure you that there are no issues with the encoding of SAML messages by our product.
Have you tested with the third party identity provider?
If so, and you're seeing an error, please provide the details.
[/quote]

I did not use: HTTP-Redirect ,, I used HTTP-Post in my project.
Kindly check Attached file for generated log.
the Post message is NOT URL Encoded.
Waiting your reply.

14

The SAMLRequest=… I included above is using the HTTP-Post binding.
It’s the post data sent by the browser to the IdP.
The log shows the HTML returned in the HTTP response.
What you should look at is the resulting HTTP Post to the IdP.
This definitely is encoded correctly.