Create SAML Assertion for 3rd Party Application with custom data in Assertion Payload in C# .NET Core

user_3812630 0
Viewed 1344

I am creating an application that needs to authenticate a User for a 3rd Party Application. The requirement is that I need to provide the 3rd Party a SAML Assertion Token which they verify.

So my application is acting as the Identity Provider, and the 3rd Party Application is the Service Provider.

I also need to include a load of user data within the payload of the SAML Assertion Token. The 3rd party once they receive the SAML token should then be able to extract this data.

My application will be a .NET Core application and once the user is authenticated I will redirect the user to a URL for the 3rd party application with the SAML Token in the Request Header.

Any ideas as to best achieve this. Ideally I'd want to use some standard library to construct the SAML Assertion.

Thanks.

saml .net c#
2 Answers

I'm assuming your IdP-implementation should use SAML protocol? I'm asking because your question isn't completely clear in this regard, because WS-Federation (in conjunction with SAML1.1 tokens) could be possible, too.

First of all, it'd be probably a good idea to not write your own IdP but use an existing product.

  • If you want/have to stick with Microsoft technologies, then AD FS would be a good candidate for you. It's a Windows Server feature used on premise.
  • Furthermore there are several commercial products (e.g. Auth0 or Onelogin).
  • Another existing product to be used on premise which is written in C# and is heavily customizable is IdentityServer. Have a look at it. I'm not very familiar with it, but it seems to me that the support for SAML2 protocol isn't part of the free package and has to be paid.
  • An alternative (just one, there are plenty) could be SimpleSAMLphp if you're not bound to Microsoft.
  • If you're about to write your IdP completly from scratch, then have a look at Sustainsys.Saml2 which is a library that primarily focusses on implementing Service Providers but can be used for IdPs, too.
user_5948320
user_38126300
Related