.NET IDP - missing signature in generated SAML response
"Wong, Eldon" <[email protected]> Tue, 17 May 2005 18:24:34 +1000
| Newsgroups | gmane.comp.sourceid.sso.devel |
|---|---|
| Message-ID | <21BC0C19D94AD31191180008C75B901B111075BB@ntmsg0038.corpmail.telstra.com.au> |
With ID-FF 1.1 .Net acting as IDP:
Towards the end of Authenticator.HandleAuthReturnToSP() where the
assertion is signed, final_doc is assigned as follows:
final_doc =3D XmlUtils.SignResponse(response, key,
response_serializer, context.IsDebuggingEnabled);
(where 'response' is the unsigned ResponseType object, and
final_doc is the signed XMLDocument)
Later on, the response object is stored by the artifact handler:
artifact_handler.StoreArtifact(artifact, response);
Note that 'response' is the ResponseType object prior to signing which
is stored, and later retrieved to return to the SP. Hence the missing
signature bug in the IDP-to-SP SAML response.
At first I thought it would be easy to fix, but since
IArtifactHandler.StoreArtifact() takes ResponseType as its 2nd argument
(not an XMLDocument), I figured I would need some sort of XML
Serialization/Deserialization, e.g.
ResponseType final_response =3D
(ResponseType)response_serializer.Deserialize(new XmlTextReader(new
System.IO.StringReader(final_doc.InnerXml)));
artifact_handler.StoreArtifact(artifact, final_response);
But I found that 'final_response' does not capture the signature. I then
re-constructed my 'response_serializer' like this:
XmlSerializer response_serializer =3D new XmlSerializer(
typeof(ResponseType),
new Type[]
{
typeof(System.Security.Cryptography.Xml.Signature)
.... etc
});
I received this exception:
System.InvalidOperationException: You must implement a default accessor
on System.Security.Cryptography.Xml.SignedInfo because it inherits from
ICollection.
I also tried adding typeof(System.Security.Cryptography.Xml.SignedInfo)
to the constructor call of my 'response_serializer', and received more
exception.
At this point I figured that I do not have enough knowledge on .NET
Serialization/Deserialization of xmldsig.
Could anyone please help? I'm in urgent need to get this working.
Alternatively if there's a more straightforward fix to the missing
signature bug, please let me know.
Thanks in advance!
Regards
Eldon