Required object identifier (OID) cannot be found

SAML for ASP.NET
1

When send request to the SP I call SAMLIdentityProvider.InitiateSSO but it raises the error:

Required object identifier (OID) cannot be found.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Security.Cryptography.CryptographicUnexpectedOperationException: Required object identifier (OID) cannot be found.

Stack Trace:


[CryptographicUnexpectedOperationException: Required object identifier (OID) cannot be found.]
System.Security.Cryptography.RSAPKCS1SignatureFormatter.CreateSignature(Byte[] rgbHash) +2441808
System.Security.Cryptography.AsymmetricSignatureFormatter.CreateSignature(HashAlgorithm hash) +59
System.Security.Cryptography.Xml.SignedXml.ComputeSignature() +272
ComponentSpace.SAML2.Utility.XmlSignature.Generate(XmlElement xmlElement, String elementId, AsymmetricAlgorithm signingKey, KeyInfo keyInfo, SignedXml signedXml, String inclusiveNamespacesPrefixList, String digestMethod, String signatureMethod) in C:\Sandboxes\ComponentSpace\SAMLv20\Library\Utility\XmlSignature.cs:403

[SAMLSignatureException: Failed to generate the XML signature.]
ComponentSpace.SAML2.Utility.XmlSignature.Generate(XmlElement xmlElement, String elementId, AsymmetricAlgorithm signingKey, KeyInfo keyInfo, SignedXml signedXml, String inclusiveNamespacesPrefixList, String digestMethod, String signatureMethod) in C:\Sandboxes\ComponentSpace\SAMLv20\Library\Utility\XmlSignature.cs:415
ComponentSpace.SAML2.Utility.XmlSignature.Generate(XmlElement xmlElement, String elementId, AsymmetricAlgorithm signingKey, X509Certificate2Collection x509Certificates, SignedXml signedXml, String inclusiveNamespacesPrefixList, String digestMethod, String signatureMethod) in C:\Sandboxes\ComponentSpace\SAMLv20\Library\Utility\XmlSignature.cs:518
ComponentSpace.SAML2.Utility.XmlSignature.Generate(XmlElement xmlElement, String elementId, AsymmetricAlgorithm signingKey, X509Certificate2 x509Certificate, SignedXml signedXml, String inclusiveNamespacesPrefixList, String digestMethod, String signatureMethod) in C:\Sandboxes\ComponentSpace\SAMLv20\Library\Utility\XmlSignature.cs:566
ComponentSpace.SAML2.Protocols.SAMLMessageSignature.Generate(XmlElement xmlElement, AsymmetricAlgorithm signingKey, X509Certificate2 x509Certificate, String inclusiveNamespacesPrefixList, String digestMethod, String signatureMethod) in C:\Sandboxes\ComponentSpace\SAMLv20\Library\Protocols\SAMLMessageSignature.cs:316
ComponentSpace.SAML2.InternalSAMLIdentityProvider.CreateSAMLResponse(String userName, SAMLAttribute[] attributes, Status status, String assertionConsumerServiceUrl) in C:\Sandboxes\ComponentSpace\SAMLv20\Library\InternalSAMLIdentityProvider.cs:605
ComponentSpace.SAML2.InternalSAMLIdentityProvider.InitiateSSO(HttpResponse httpResponse, String userName, SAMLAttribute[] attributes, String relayState, String partnerSP, String assertionConsumerServiceUrl) in C:\Sandboxes\ComponentSpace\SAMLv20\Library\InternalSAMLIdentityProvider.cs:986
ExampleIdentityProvider._Default.ssoLinkButton_Click(Object sender, EventArgs e) in d:\Projects\NewRIS\branches\Bahrain-Dev\SharedProject\ExampleIdentityProvider\Default.aspx.cs:43
System.Web.UI.WebControls.LinkButton.OnClick(EventArgs e) +118
System.Web.UI.WebControls.LinkButton.RaisePostBackEvent(String eventArgument) +113
System.Web.UI.WebControls.LinkButton.System.Web.UI.IPostBackEventHandler.RaisePostBackEvent(String eventArgument) +9
System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument) +13
System.Web.UI.Page.RaisePostBackEvent(NameValueCollection postData) +176
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +5563


2

The most likely cause is that the signature algorithm isn’t supported by the .NET framework.
Is this a SHA-256 signature you’re trying to generate?
What version of the .NET framework are you using?
What version of the SAML2 DLL are you using?
http://www.componentspace.com/Forums/31/Determining-the-Component-Version-and-License

3
[quote]
ComponentSpace - 2/22/2017
The most likely cause is that the signature algorithm isn't supported by the .NET framework.
Is this a SHA-256 signature you're trying to generate?
What version of the .NET framework are you using?
What version of the SAML2 DLL are you using?
http://www.componentspace.com/Forums/31/Determining-the-Component-Version-and-License
[/quote]


Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.0.30319.1
SAML2 DLL : 2.6.0.18
4

Could you please run Microsoft’s certutil.exe on your PFX file?
certutil -dump your.pfx
What’s the name of the provider?

5
[quote]
ComponentSpace - 2/22/2017
Could you please run Microsoft's certutil.exe on your PFX file?
certutil -dump your.pfx
What's the name of the provider?
[/quote]


CN=www.idp.com
6

That’s the subject name. It looks like you’re using one of our test certificates.
Here’s what I get when on run certutil on our test idp.pfx.

certutil -dump idp.pfx
Enter PFX password:
================ Certificate 0 ================
================ Begin Nesting Level 1 ================
Element 0:
Serial Number: 74f0ebfe22358db8433138f9558c9af9
Issuer: CN=www.idp.com
NotBefore: 22/11/2013 6:20 PM
NotAfter: 1/01/2050 12:00 AM
Subject: CN=www.idp.com
Signature matches Public Key
Root Certificate: Subject matches Issuer
Cert Hash(sha1): a6 a4 ae 4e 0b 37 8e c7 36 78 e5 81 26 90 af 50 e3 ec 37 69
---------------- End Nesting Level 1 ----------------
Provider = Microsoft Enhanced RSA and AES Cryptographic Provider
Encryption test passed
CertUtil: -dump command completed successfully.

The provider is “Microsoft Enhanced RSA and AES Cryptographic Provider”.

7
[quote]
ComponentSpace - 2/23/2017
That's the subject name. It looks like you're using one of our test certificates.
Here's what I get when on run certutil on our test idp.pfx.

certutil -dump idp.pfx
Enter PFX password:
================ Certificate 0 ================
================ Begin Nesting Level 1 ================
Element 0:
Serial Number: 74f0ebfe22358db8433138f9558c9af9
Issuer: CN=www.idp.com
NotBefore: 22/11/2013 6:20 PM
NotAfter: 1/01/2050 12:00 AM
Subject: CN=www.idp.com
Signature matches Public Key
Root Certificate: Subject matches Issuer
Cert Hash(sha1): a6 a4 ae 4e 0b 37 8e c7 36 78 e5 81 26 90 af 50 e3 ec 37 69
---------------- End Nesting Level 1 ----------------
Provider = Microsoft Enhanced RSA and AES Cryptographic Provider
Encryption test passed
CertUtil: -dump command completed successfully.

The provider is "Microsoft Enhanced RSA and AES Cryptographic Provider".
[/quote]


Sorriy, the provider is just "Microsoft Enhanced RSA and AES Cryptographic Provider" here.
8

Ok, thanks.
What OS are you running on?
Does the same issue happen on a different machine?
There must be some environmental issue causing this problem.

9
[quote]
ComponentSpace - 2/23/2017
Ok, thanks.
What OS are you running on?
Does the same issue happen on a different machine?
There must be some environmental issue causing this problem.
[/quote]


Windows Server 2008 R2 Standard
10

Could you try a different machine?
For example, Windows Server 2012 R2 or later or Windows 10.

11
[quote]
ComponentSpace - 2/23/2017
Could you try a different machine?
For example, Windows Server 2012 R2 or later or Windows 10.
[/quote]


It works only in Windows 7 and Windows Server 2012 R2.
12

It’s surprising you’re seeing an issue on this OS.
Do you have the latest services packs on your 2008 R2 server?
As an experiment, could you revert to SHA-1 signatures?
You do this by setting the following for your in saml.config.
SignatureMethod=“<a href=“http://www.w3.org/2000/09/xmldsig#rsa-sha1"”>http://www.w3.org/2000/09/xmldsig#rsa-sha1”
http://www.componentspace.com/Forums/5316/SHA1-vs-SHA256-XML-signatures
That will confirm whether it’s a SHA-256 related issue.

13

If running Windows Server 2008 and an error is encountered attempting to generate SHA-256 signatures, please ensure the following.
1. All Windows updates have been applied including <ahref=“https: technet.microsoft.com=”" en-us=“” library=“” security=“” 3033929.aspx"=“”>https://technet.microsoft.com/en-us/library/security/3033929.aspx.
2. .NET framework v4.5.1 or later is installed. This is required even if your application targets an earlier version of the .NET framework.

Typical errors include:
1. CryptographicUnexpectedOperationException: Required object identifier (OID) cannot be found
2. NotSupportedException: Method is not supported
with System.Security.Cryptography.Xml.SignedXml.ComputeSignature in the call stack.
</ahref="https:>