ISamlServiceProvier.SamlState is empty during GetLocalSPConfiguration()

SAML for ASP.NET Core
1

Hi Team,

We have added ComponentSpace as an SSO option. It worked fine for few days.
Recently we are getting an error ‘Invalid configuration ‘‘.‘ intermittently.

public override Task GetLocalServiceProviderConfigurationAsync(string configurationName)
{
if(int.TryParse(configurationName, out int clientID))
{
var samlConfig = _securityService.GetSAMLConfiguration(clientID);
/* rest of code */
}
else {
throw new InvalidOperationException($“Invalid configuration ‘{configurationName}’.”); }
}

This is because the param ‘configurationName‘ is coming as empty.

The sso initiation method is as follows:

private ActionResult SsoRedirect(IClient client)

    {

        string redirectUrl;

        if(client.SsoProvider == SsoProvider.ComponentSpace)

        {

_samlServiceProvider.SetConfigurationNameAsync(client.ID.ToString()).GetAwaiter().GetResult();

            var relayState = System.Text.Json.JsonSerializer.Serialize(new SsoRelayState

            {

                ReturnUrl = authConfig.AssertionConsumerServiceUrl,

            });

            relayState = Convert.ToBase64String(Encoding.UTF8.GetBytes(relayState));

            \_samlServiceProvider.InitiateSsoAsync(relayState: relayState).GetAwaiter().GetResult();

            redirectUrl = string.Empty;

            return new EmptyResult();

        }

    }

Note:

  1. Client.ID is always non-null value, while debugging i saw the value populating, it is a primary key in our DB.
  2. This doesnt happen every time though. Once the Application pool is refreshed/restarted in IIS, the problem goes away.
  3. Thought to registering the ISamlService service provider under TransientScope, but the internal implementation of AddSaml() takes care of that already.
  4. SSOConfigurationResolver - implementation of AbstractSamlConfigurationResolver is registered as AddScoped(), just before AddSaml()

I am suspecting _samlServiceProvider.SetConfigurationNameAsync(client.ID.ToString()).GetAwaiter().GetResult();
This should be used with await, instead of GetAwaiter()

We are unable to reproduce the issue on lower environments.
Could you please help.

Thanks,
Hemanth

2

Hi Hemanth,

I’m not sure but both SetConfigurationNameAsync and InitiateSsoAsync are asynchronous methods and would normally be called asynchronously using await.

Have you tried that?

Also, if you only have a single SAML configuration, there’s no requirement to call SetConfigurationNameAsync. It’s only required when there are multiple SAML configurations and one has to be selected.

If there’s still an issue, please email support@componentspace.com a larger section of your code showing exactly how the SAML configuration is being setup and used. Please also mention your forum post.

Thanks.