External AuthnRequest and InResponseTo

SAML for ASP.NET
1

Hi there,

I’m investigating a flow where the original SAML AuthnRequest is generated and tracked outside of ComponentSpace.

We currently have long-established IdP-initiated and a more recent SP-initiated SAML flows working with ComponentSpace 6.3 - High-Level API

We’re now investigating a new mobile authentication flow where the SAML AuthnRequest is generated and tracked by a mobile middleware by a third-party dev team, rather than our application

Their proposed solution is:

  1. The mobile middleware generates the AuthnRequest and sends the user to the IdP.
  2. The IdP authenticates the user.
  3. The SAML Response is posted to an ACS implemented using ComponentSpace in our application.
  4. After validating the SAML Response, user, etc our application reads the InResponseTo value and passes it back to the mobile middleware for request correlation.

A few questions:

  1. Can ComponentSpace validate a SAML Response when the original AuthnRequest was not generated or tracked by ComponentSpace?
  2. Is DisableInResponseToCheck the correct setting for this scenario?
  3. If enabled, which validations remain in place?
  4. After successful validation, what is the recommended way to obtain a trusted InResponseTo value?
  5. Are there any security concerns or recommended practices for this approach.

Cheers, Patrick

2

Hi Patrick,

I just want to confirm, you’re referring to SAML for ASP.NET rather than SAML for ASP.NET Core.

Assuming so, in response to your questions:

  1. Yes. However, we will throw an exception unless you disable the InResponseTo check.
  2. Yes. Set DisableInResponseToCheck to true in the partner identity provider configuration.
  3. All other validations remain in place.
  4. See the code below.
  5. Non-standard flows are always a potential concern. However, without knowing the full details of the proposed solution, I can’t think of any specific security concerns at the moment.

After calling SAMLServiceProvider.ReceiveSSO, the following code retrieves the InResponseTo value.

using ComponentSpace.SAML2.Bindings;
using ComponentSpace.SAML2.Protocols;   

HTTPPostBinding.ReceiveResponse(new HttpRequestWrapper(Request), out XmlElement samlResponseElement, out string relayState);
var samlResponse = new SAMLResponse(samlResponseElement);
var inResponseTo = samlResponse.InResponseTo;
1 Like