Signature is invalid while calling Saml2PostBinding.Unbind()

Viewed 321

We are getting "Signature is invalid" errors while calling Unbind() and stumbled upon this in code. https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2/blob/42a2d6de46f38d14f0c6f607594d19f2366ad5f2/src/ITfoxtec.Identity.Saml2/Bindings/Saml2PostBinding.cs#L106

Why validateXmlSignature argmument is always true within UnbindInternal()?

protected override Saml2Request UnbindInternal(HttpRequest request, Saml2Request saml2RequestResponse, string messageName)
{
  UnbindInternal(request, saml2RequestResponse);

  return Read(request, saml2RequestResponse, messageName, true, true);
}

Our calling code:

 var binding = new Saml2PostBinding();
var saml2AuthnResponse = new Saml2AuthnResponse(saml2Config);

binding.ReadSamlResponse(Request.ToGenericHttpRequest(), saml2AuthnResponse);
if (saml2AuthnResponse.Status != Saml2StatusCodes.Success)
{   
 throw new AuthenticationException($"SAML Response status: {saml2AuthnResponse.Status}");
}

binding.Unbind(Request.ToGenericHttpRequest(), saml2AuthnResponse);
1 Answers

The validateXmlSignature argument is always true because the signature is placed in XML in a POST binding and the SAML 2.0 Authn response signature has to be validated. The signature validation is the trust of the SAML 2.0 token.

Related