Comments (3)
I didn't know that this was allowed (but it is, I checked the specification), but it makes sense as the .NET Framework classes expect all assertions to be signed. There's a bit of a hack in the response processing to bypass signature verification of the assertion. Which is okay according to the specification (Core 5.3), as long as the signature on the response is verified.
I think that it's a good idea to make the assertion signature verification more flexible, but it requires that part of the response processing is redesigned. Specifically I think that Saml2Response.CreateClaims should take a new flag that indicates whether signature verification is required or not.
from saml2.
When implementing this it would be good to be aware about the breaking parts in signature verification in context of SAML described in this paper (see PDF):
http://www.nds.rub.de/research/publications/BreakingSAML/
from saml2.
Thanks for pointing that out. So far I have just used the existing xml signature verification functionality without any further analysis. If so many of the existing frameworks are vulnerable it is definitely something that has to be looked into.
from saml2.
Related Issues (20)
- How to implement session timeout in asp.net core HOT 2
- Sustainsys.saml2: IDX10214: Audience validation failed. Did not match: validationParameters.ValidAudience HOT 5
- How to use authenticationhandler in .net core like we were using in .net framework HOT 4
- SAML authentication with different Active Directory HOT 2
- Support dynamically updating the ServiceCertificates during rollover (ASP.NET Core) HOT 1
- Hangs on return ASC
- Configuration to add User-Agent header for metadata HTTP request HOT 4
- Reference URI pointing to Response elmente and not the Assertion HOT 2
- Saml2 SLO in IFrames with 3rd party cookies disabled HOT 4
- How to create a saml2response HOT 1
- Wrap CommandResultExtensions.Apply with error checking to trap null object exceptions
- Thank you 💖 HOT 1
- Federated logout not possible, redirecting to post-logout HOT 2
- AspNetCore package for Blazor Server Side? HOT 2
- Redirect back to SP after Single Logout HOT 1
- Callback AuthenticateAsync external Succeeded always false HOT 1
- Dynamic Idp provider list sign out Issue HOT 1
- Could not load type 'Sustainsys.Saml2.WebSso.Saml2Module' from assembly 'Sustainsys.Saml2' HOT 3
- Using the library correctly
- Error loading metadata xml file on Firefox HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from saml2.