Background:
I've been working with the ITFoxtec.Identity.Saml2 - TestIdpCore project to create a custom IdP. With a little trouble I've managed to get signed/encrypted assertions working (against the OneLogin wordpress-saml plugin).
My troubles included:
- The onelogin wordpress-saml token decryption code appears to have a bug that invalidates / breaks the assertion's signature: Issue #136
- TestIdPCore has an issue with loading private keys (at least in .NET core 6 in my environment) - Pull Request #112
- [TestIdPCore] does not include the token encryption certificates per relying party (instead it seems to be in the Saml2 config element) - Pull Request #113
After address the above in my environment the "trivial" example then worked: a hard-coded set of claims are returned in the AuthController.Login() Action method. I then attempted to setup an actual login (username/password) View (with a corresponding UserAuthenticationRequest model that contained a Username and Password property).
I modifying the existing Login (GET reqeuest) Action method to return a new View("Authentication") which displays a simple Username/Password form (tied to my new "UserAuthenticationRequest" model).
I then added a second public async Task<IActionResult> Login(UserAuthenticationRequest request) Action method with an [HttpPost("Login")] attribute as well as the [ValidateAntiForgeryToken] attribute migrating the original code from the previously existing Login() method. However, the Saml2RedirectBinding class explicitly checks the Request method and throws an exception when it sees POST instead of GET:
InvalidSaml2BindingException: Not HTTP GET Method.
ITfoxtec.Identity.Saml2.Saml2RedirectBinding.Read(HttpRequest request, Saml2Request saml2RequestResponse, string messageName, bool validate, bool detectReplayedTokens)
ITfoxtec.Identity.Saml2.Saml2Binding<T>.ReadSamlRequest(HttpRequest request, Saml2Request saml2Request)
MyExampleIdP.Controllers.AuthController.ReadRelyingPartyFromLoginRequest<T>(Saml2Binding<T> binding) in AuthController.cs
I've tried using the Saml2PostBinding as well but it then expects the SAMLRequest and RelayState parameters to be submitted with the Login form.
I see a few other StackOverflow posts asking how to create this login form, but there doesn't seem to be any guidance on how to overcome the above issues:
My Question:
What is the correct approach to extending TestIdpCore so that it can include a trivial username/password login form? I will gladly submit another pull request to the TestIdpCore project if someone could point me in the correct direction.
Finally, thank you to ITFoxtec for developing and sharing with the community such a complete open source .NET/.NET core implementation of a SAML 2.0 library capable of both the IdP and the RelyingParty roles.