I'm using the latest C# SAML2 library (4.3.1), and have been able to use it successfully with Okta; however, when trying to integrate with another identity provider, I'm getting the following error:
ArgumentException: IDX13300: 'System.String' must be an absolute Uri, was: 'System.Uri'
It seems to be complaining about the saml:AuthnContextDeclRef attribute, which has the value: ncid/secure/form/30min/uri
I'm not sure, but I think maybe this attribute is expected to be an absolute Uri by the library. The customer says this value comes from their contract and is the same for everyone, so it can't be changed. They have other applications successfully integrated (they mentioned some are using ComponentSpace). Is there any setting I can change or fix you can provide for this to work? I've looked through the available settings and nothing looks like it is relevant. The only thing I can think to do at this point is to try another SAML library.
UPDATE:
So I was able to track the issue down to the Declaration Reference attribute not being an absolute Uri. This validation is in the Microsoft.IdentityModel.Tokens.Saml2.Saml2AuthenticationContext class which represents a portion of the Saml2 token. I agree that the best solution would be to change the Declaration Reference to an absolute Uri, but since the customer says they can't or won't change the value, I needed a solution.
I was able to download the ITFoxtec.Identity.Saml2 source code and make a few tweaks so it uses a custom Saml2Serializer that overrides the ReadAuthenticationContext method and skips the part that sets the Declaration Reference on the Authentication Context. ITFoxtec doesn’t use this property… in fact, it has code that sets it to null if it has a value, so preventing the property from getting set in the first place shouldn’t cause any issues, and it allows the SAML token to be read without triggering the validation error.