Cannot build IdentitySaml2 projects

Question

I am trying to implement SSO using IdentitySaml2 to authenticate but the projects are not being built. I am using .net framework 4.7.2.

UPDATED: Though I could not build the main source solution (ITfoxtec.Identity.Saml2). I managed to create a sample site and install nuget package. I also added code files like IdentityConfig, Authcontroller, DefaultClaimsAuthenticationManager and views and added the settings below in webconfig. I am not sure about these settings and did not find proper documentation. Currently idpmedatadata is throwing exception due to improper url.

<add key="Saml2:IdPMetadata" value="https://localhost:44305/metadata"/>
<add key="Saml2:Issuer" value="urn:itfoxtec:identity:saml2:testwebapp"/>
<add key="Saml2:SingleSignOnDestination" value="https://test-adfs.itfoxtec.com/adfs/ls/"/>
<add key="Saml2:SingleLogoutDestination" value="https://test-adfs.itfoxtec.com/adfs/ls/"/>
<add key="Saml2:SignatureAlgorithm" value="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<add key="Saml2:SigningCertificateFile" value="~/App_Data/itfoxtec.identity.saml2.testwebapp_Certificate.pfx"/>
<add key="Saml2:SigningCertificatePassword" value="!QAZ2wsx"/>
<add key="Saml2:CertificateValidationMode" value="ChainTrust"/>
<add key="Saml2:RevocationMode" value="NoCheck"/>

Answer 1

Can you please be more specific in regard to the exception?

If you are building a ASP.NET MVC .NET 4.7.2 solution you should use the ITfoxtec.Identity.Saml2.Mvc Version 3.0.0 package. I expect it is not at .NET Core application.

You can find examples her: https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2/tree/master/test

UPDATED: The ITfoxtec Identity Saml2 component acting as a relying party can either be configured with or without the IdP metadata.

Using the IdP metadata

The IdP trust configuration only needs the metadata:

<add key="Saml2:IdPMetadata" value="https://localhost:44305/metadata"/>

The IdP metadata is loaded in IdentityConfig.RegisterIdentity() like this:

var entityDescriptor = new EntityDescriptor();
entityDescriptor.ReadIdPSsoDescriptorFromUrl(new Uri(ConfigurationManager.AppSettings["Saml2:IdPMetadata"]));
if (entityDescriptor.IdPSsoDescriptor != null)
{
    Saml2Configuration.SingleSignOnDestination = entityDescriptor.IdPSsoDescriptor.SingleSignOnServices.First().Location;
    Saml2Configuration.SingleLogoutDestination = entityDescriptor.IdPSsoDescriptor.SingleLogoutServices.First().Location;
    Saml2Configuration.SignatureValidationCertificates.AddRange(entityDescriptor.IdPSsoDescriptor.SigningCertificates);
}
else
{
    throw new Exception("IdPSsoDescriptor not loaded from metadata.");
}

The metadata kan be loaded online ReadIdPSsoDescriptorFromUrl(...) or from a file ReadIdPSsoDescriptorFromFile(...) or from a string ReadIdPSsoDescriptor(...)

Configure the IdP without metadata

The IdP trust needs the IdP login and logout endpoints as well as the IdP signing certificate:

<add key="Saml2:SingleSignOnDestination" value="https://some-idp.test.com/login/"/>
<add key="Saml2:SingleLogoutDestination" value="https://some-idp.test.com/logout/"/>
<add key="Saml2:SignatureValidationCertificate" value="~/App_Data/IdP_signing_certificate.crt"/>

The IdP configuration is loaded in IdentityConfig.RegisterIdentity() like this:

Saml2Configuration.SingleSignOnDestination = new Uri(ConfigurationManager.AppSettings["Saml2:SingleSignOnDestination"]);
Saml2Configuration.SingleLogoutDestination = new Uri(ConfigurationManager.AppSettings["Saml2:SingleLogoutDestination"]);

Saml2Configuration.SignatureValidationCertificates.Add(CertificateUtil.Load(HttpContext.Current.Server.MapPath(ConfigurationManager.AppSettings["Saml2:SignatureValidationCertificate"])));

Relying party identifier

The unik relying party identifier:

<add key="Saml2:Issuer" value="urn:itfoxtec:identity:saml2:testwebapp"/>

Signing certificate

The required signature algorithm is most likely SHA-256:

<add key="Saml2:SignatureAlgorithm" value="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>

Instead of loading the signing certificate from a file like this:

<add key="Saml2:SigningCertificateFile" value="~/App_Data/itfoxtec.identity.saml2.testwebapp_Certificate.pfx"/>
<add key="Saml2:SigningCertificatePassword" value="!QAZ2wsx"/>

The certificate can be loaded by a thumbprint from the Windows Certificate Store or a TLS certificate in a Azure App Service:

<add key="SigningCertificateThumbprint" value="XXXXX...XXXXX"/>

Then the IdentityConfig.RegisterIdentity() needs to be changed to load the certificate by thumbprint:

Saml2Configuration.SigningCertificate = CertificateUtil.Load(StoreName.My, StoreLocation.CurrentUser, X509FindType.FindByThumbprint, ConfigurationManager.AppSettings["Saml2:SigningCertificateThumbprint"]);

Certificate validation

The IdP certificate chain and revocation can be validated if required.

Normally the certificate chain and revocation is not validated:

<add key="Saml2:CertificateValidationMode" value="None"/>
<add key="Saml2:RevocationMode" value="NoCheck"/>

It required to validate the certificate chain and revocation:

<add key="Saml2:CertificateValidationMode" value="ChainTrust"/>
<add key="Saml2:RevocationMode" value="Online"/>