How to created signed AuthNRequest?

Question

I am interfacing with an IDP and have a basic AuthNRequest created as follows:

<samlp:AuthnRequest
  xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
  xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
  ID="IDTest1" 
  Version="2.0"
  IssueInstant="2013-03-04T09:21:59"
  AssertionConsumerServiceIndex="0"
  AttributeConsumingServiceIndex="0">
  <saml:Issuer>https://myapp.com/saml2/sp</saml:Issuer> 
 <samlp:NameIDPolicy
   AllowCreate="true"
   Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
</samlp:AuthnRequest>     

IDP wants me send the request as signed. My questions are:

1. How do I set digest value?
2. How do I set Signature value?
3. For x509 certificate, I set the public key of my app. Correct?
4. What is the data that is used to compute any of the values? Is it my original auth request without Signature element?

Answer 1

Your question is inadequate!

The AuthRequest you're sending seems to be REDIRECT request where you will not see Digest, Signature and Certificate since all these details will be in URL as a parameter.

Try using POST SSO request, where you will see Digest, Signature and Certificate in SAML request.

Some of the points:

Common

• Both IdP and SP should share their Metadata, which will have their basic configuration like id, signing algorithm, hashing method, public key etc.
• So, based on the contract between IdP you should hash and sign your request in your preferred programming language.

SP:

• You should encrypt using your public key.
• You should sign using your private key.
• You should encode your request using Base64.

IdP:

• They will identity using the public key in the request.
• They will respond back with encrypted and signed XML.
• You should decrypt and unsign the response.

Quick Links

1. Official Doc about SAML 2.0

2. SAML Online Tool by OneLogin

Answer 2

Just to note that a lot of this is covered in the documentation:

SAML metadata.

To have the request signed you need to add something like this (normally found in the sp.xml):

<SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="false"
                 protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

The signing key would look something like:

<KeyDescriptor use="signing">
    <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
            <ds:X509Certificate>
                MIIDWTC...CAkGgAwIBAgIEe+a+/uaSZCp5g2z+hRWRV+DyfQc9nO
            </ds:X509Certificate>
        </ds:X509Data>
    </ds:KeyInfo>
</KeyDescriptor>

where the MII... is the public key.

As per @Stefan, it's much easier to use a library.