SecureBlackbox 2020 .NET Edition

Questions / Feedback?

SAMLWriter Component

Properties   Methods   Events   Configuration Settings   Errors  

The SAMLWriter component offers SAML message generation functions.

Syntax

nsoftware.SecureBlackbox.Samlwriter

Remarks

SAMLWriter provides means of serialization of SAML entities into valid SAML protocol messages. Together with SAMLReader, this class provides fine-grained access to the composition of SAML requests, responses, assertions, and statements. You can use it as part of your SAML client or SAML server implementation for creating individual SAML entities.

SAMLReader and SAMLWriter are independent of SAML server controls that are also included in SecureBlackbox, and are aimed at scenarios that require lower-level access to SAML functionality than that provided by the server controls.

SAMLWriter can create the following kinds of SAML messages:

  • AssertionIDRequest
  • SubjectQuery
  • AuthnQuery
  • AttributeQuery
  • AuthzDecisionQuery
  • AuthnRequest
  • ManageNameIDRequest
  • LogoutRequest
  • NameIDMappingRequest
  • ArtifactResolve
  • Response

Please find below a quick-and-dirty example of the use of SAMLWriter class for creating a signed AuthnRequest message:

  Samlwriter writer = new Samlwriter();

  // configuring general message properties
  writer.Destination = "http://destination-url.com";
  writer.IssueInstant = DateTime.UtcNow.ToString("yyyy-MM-ddTHH:mm:ss.fffZ");
  writer.Issuer = "Value=https://issuer-url.com;Format=urn:oasis:names:tc:SAML:2.0:nameid-format:entity;IDType=Issuer";

  // configuring general AuthnRequest properties
  writer.AuthnRequest.IsPassive = false;
  writer.AuthnRequest.UseIsPassive = true;
  writer.AuthnRequest.ForceAuthn = true;
  writer.AuthnRequest.ProtocolBinding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
  writer.AuthnRequest.AssertionConsumerServiceURL = "https://assertion-consumer-url.com";
  writer.AuthnRequest.AttributeConsumingServiceIndex = 1;
  writer.AuthnRequest.NameIDPolicyAllowCreate = false;
  writer.AuthnRequest.NameIDPolicyFormat = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent";
  writer.AuthnRequest.ConditionsNotBefore = DateTime.UtcNow.ToString("yyyy-MM-ddTHH:mm:ss.fffZ");
  writer.AuthnRequest.ConditionsNotOnOrAfter = DateTime.UtcNow.AddMinutes(30).ToString("yyyy-MM-ddTHH:mm:ss.fffZ");

  // adjusting request conditions if required
  SAMLAssertionCondition cond = new SAMLAssertionCondition();
  cond.ConditionType = SAMLConditionTypes.csctOneTimeUse;
  writer.AuthnRequestConditions.Add(cond);

  // configuring signing properties
  Certificate certificate = new Certificate("C:\\Certs\\samlCert.pfx", "password");
  writer.Sign = true;
  writer.SigningCertificate = certificate;

  // creating the SAML entity of the required type
  writer.CreateNew((int)SamlwriterOutputTypes.cstyAuthnRequest);

  // adjusting low-level signature parameters
  writer.Config("SigDigestMethod=http://www.w3.org/2001/04/xmlenc#sha256");
  writer.Config("SigMethod=http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");
            
  // signing the request and serializing it to XML
  string request = writer.Save();
The above code produces the following AuthnRequest:
  <samlp:AuthnRequest 
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="53GhrzQ5f89fu214ANAR" Version="2.0" 
    IssueInstant="2021-12-15T10:39:31Z" Destination="http://destination-url.com" IsPassive="false" 
    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
    AssertionConsumerServiceURL="https://assertion-consumer-url.com" AttributeConsumingServiceIndex="1" 
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://issuer-url.com</saml:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
      <ds:SignedInfo>
        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
        <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
        <ds:Reference URI="#53GhrzQ5f89fu214ANAR">
          <ds:Transforms>
            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
          </ds:Transforms>
          <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>+xhhgXtwYN0/r9h7WAwg=</ds:DigestValue>
        </ds:Reference>
      </ds:SignedInfo>
      <ds:SignatureValue>
        jfYeIq/z8D1tJZYbVqDMoqKpdrfGMj8/zI7gbUsJbECAr00cN34md2QG0mo4cOx7pny+5
        Tht7tUzqENHqcZdmlOcZc2JcJqokVxIcLEluFiWKlNjpexkXFQKzOC1peRfTZm8SQTqtP
        Cz8IknLUc6Scfml29PHmks1PxjJDteGb/+FggsZRTGZC3a05nvH3ayvHukPeHuHssx5dX
        nj0quT8salR6fdx6lAJo/AnDHzcfBNyxAMn+ebk5VOOgVD1L3PayvXib/maj8aVI2I5UT
        o4vmfybTWKzeS8DX9We7UV+4Xowwe647t1A912xLVub/e23A18Yf1V0PXC87kttTkA==
      </ds:SignatureValue>
      <ds:KeyInfo>
        <ds:X509Data><ds:X509Certificate>
          MIIEKDCCAxCgAwIBAgIFYA3A3gIwDQYJKoZIhvcNAQELBQAwfjELMAkGA1UEBhMCVVMxC
          zAJBgNVBAgTAk5DMRQwEgYDVQQHEwtDaGFwZWwgSGlsbDEiMCAGCSqGSIb3DQEJARMTc2
          FsZXNAbnNvZnR3YXJlLmNvbTEoMCYGA1UEAxMfU2VjdXJlQmxhY2tib3ggRGVtbyBDZXJ
          0aWZpY2F0ZTAeFw0xNzA5MDEwMDAwMDBaFw0yMjA5MDEwMDAwMDBaMH4xCzAJBgNVBAYT
          AlVTMQswCQYDVQQIEwJOQzEUMBIGA1UEBxMLQ2hhcGVsIEhpbGwxIjAgBgkqhkiG9w0BC
          QETE3NhbGVzQG5zb2Z0d2FyZS5jb20xKDAmBgNVBAMTH1NlY3VyZUJsYWNrYm94IERlbW
          8gQ2VydGlmaWNhdGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCfAVIcq9o
          eoIbw56LsPjxWsX3YGkqasBQzgQymhfcDZeSvFKFis8iqArGLTUUWOaImO5t2UmjIa+4n
          YP39hb9Z1r0CMy53p83oYbbZZ7qMeji0pMAufJHqKCN8t2HNWf2HE8S9UOU7R/UHdrSAN
          JitBKV9lSG9f450yWoGNwt35ZCsOp0zqtCgvkEvteGsz01R5DDjOccs3QNu25K/Sf27KP
          CYabS6A1ehYNY/G32qoKNJhu3DN4bWje57gBWi9WSfQ3tZUOV5q2ozaNJA78Wl4fXC6RB
          CaBh0GOwXeyZoH13LJdn+lqlCSMz024ImG4yFQEENbWvE9Elku8RYTn73AgMBAAGjgaww
          gakwHwYDVR0jBBgwFoAUmt/L7GI1SH36Sp8EUBxTwuzSgqMwHQYDVR0OBBYEFJrfy+xiN
          Uh9+kqfBFAcU8Ls0oKjMA8GA1UdEwEB/wQFMAMBAf8wDwYDVR0PAQH/BAUDAwDuADBFBg
          NVHSUEPjA8BggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMDBggrBgEFBQcDBAYIKwY
          BBQUHAwgGCCsGAQUFBwMJMA0GCSqGSIb3DQEBCwUAA4IBAQBovHBbMsW/k/5iuLQQqsYS
          ng5X2iy1W+5BRb1hz0MGnHGLqJWy1ty5+bTo6g/zvT65dXIPIexLkInEenYSy75Lthr6a
          ewUcvwfl1TYXjWlMD5Nm5pM9As71+XsGSdYGXoKohbEzbT6RDByjwR+yxtatqko7e1Eg6
          InNJRTRt7al/63FSPEgSCqOX6asDVDNZ83db0dOcoeaPEiDz3liE3+tYHtKXj5/qwTtYd
          aqBZxdJfuCKZveEFe1DO3/ayDvIvG9Eme+rEjntErF+Cw9a8ukesvDuT49cRE9oTs3O7f
          6LUbhCv5zJN+dTFr75NSdWdp4yvn3nK3i2udeMnTWK0U
        </ds:X509Certificate></ds:X509Data>
      </ds:KeyInfo>
    </ds:Signature>
    <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
    <saml:Conditions NotBefore="2021-12-15T10:39:31Z" NotOnOrAfter="2021-12-15T11:09:31Z"><saml:OneTimeUse/></saml:Conditions>
  </samlp:AuthnRequest>

Property List


The following is the full list of the properties of the component with short descriptions. Click on the links for further details.

AddXMLHeaderControls the inclusion of an XML header in the message.
ArtifactProvides access to the Artifact element of the message.
ArtifactResolveQueryContains the artifact resolve query.
AssertionAttributesContains a list of assertion attributes.
AssertionConditionsContains a list of assertion conditions.
AssertionCountReturns the number of assertions in the message.
AssertionIDRequestContains the properties of AssertionIDRequest element.
AssertionInfoContains assertion information.
AssertionIssuerSpecifies the assertion issuer.
AssertionStatementsContains assertion statements.
AssertionSubjectConfirmationsProvides access to assertion SubjectConfirmations list.
AssertionSubjectIDSpecifies the assertion subject ID.
AttrQueryAttributesContains a list of attribute query attributes.
AuthnQueryProvides access to the AuthnQuery SAML element.
AuthnRequestPublishes the properties of AuthnRequest element.
AuthnRequestConditionsContains a list of AuthnRequest conditions.
AuthnRequestScopingIDPListProvides access to the list of scoping IDP eleements.
AuthzDecisionQueryProvides access to AuthzDecisionQuery element.
BindingSpecifies the type of the binding to use.
ConsentContains the Consent parameter of the request.
DestinationContains the Destination parameter of the SAML object.
EncryptionCertificateSets the encryption certificate.
IDThe ID of the request.
InResponseToContains the InResponseTo property of the SAML request.
IssueInstantContains request issuance timestamp.
IssuerSets the issuer of the message.
LogoutRequestContains the properties of SAML LogoutRequest element.
ManageNameIDRequestProvides access to ManageNameIDRequest element.
NameIDMappingRequestPublishes the properties of NameIDMappingRequest entity.
OutputTypeReturns the SAML type of message being created.
POSTBindingExposes the POST binding properties.
ProfileSpecifies a pre-defined profile to apply when creating the signature.
RedirectBindingPublishes the redirect binding settings.
RedirectBindingCertificateContains a certificate to sign the redirect binding.
ResponseProvides access to the SAML response object properties.
SignSpecifies whether the created SAML message should be signed.
SigningCertificateThe certificate to be used for signing.
SigningChainThe signing certificate chain.
SubjectConfirmationsProvides access to the list of subject confirmation elements.
SubjectIDSets the subject of the message.
VersionSpecifies the protocol version of the SAML message.

Method List


The following is the full list of the methods of the component with short descriptions. Click on the links for further details.

AddAdviceAssertionAdds an advice assertion to the message.
AddAssertionAdds assertion to a SAML message.
ClearAssertionResets the contents of all assertion-related properties.
CompareIDsCompares two SAML IDs.
ConfigSets or retrieves a configuration setting.
CreateNewCreates a new SAML message with the given type.
GetIDPropReturns an element of the SAML ID.
RemoveAdviceRemoves an advice from an assertion.
RemoveAdviceAssertionRemoves an advice from an assertion.
RemoveAllAssertionsRemoves all assertions currently configured in the message.
RemoveAssertionRemoves an assertion from the message.
SaveSaves the configured message to a string.
SaveBytesSaves the configured message to a byte array.
SaveFileSaves the configured message to a file.
SaveStreamSaves the configured message to a stream.

Event List


The following is the full list of the events fired by the component with short descriptions. Click on the links for further details.

ErrorFires to report an error condition.
NotificationThis event notifies the application about an underlying control flow event.

Configuration Settings


The following is a list of configuration settings for the component with short descriptions. Click on the links for further details.

IgnoreSystemTrustWhether trusted Windows Certificate Stores should be treated as trusted.
SigAfterIssuerSpecifies whether to insert the signature after the issuer tag in the SAML document.
SigCanonicalizationMethodThe canonicalization method to use in the signature.
SigDigestMethodThe digest method to use.
SigMethodThe signature method to use.
TolerateMinorChainIssuesWhether to tolerate minor chain issues.
UseMicrosoftCTLEnables or disables automatic use of Microsoft online certificate trust list.
UseSystemCertificatesEnables or disables the use of the system certificates.
CheckKeyIntegrityBeforeUseEnables or disable private key integrity check before use.
CookieCachingSpecifies whether a cookie cache should be used for HTTP(S) transports.
CookiesGets or sets local cookies for the component (supported for HTTPClient, RESTClient and SOAPClient only).
DefDeriveKeyIterationsSpecifies the default key derivation algorithm iteration count.
EnableClientSideSSLFFDHEEnables or disables finite field DHE key exchange support in TLS clients.
GlobalCookiesGets or sets global cookies for all the HTTP transports.
HttpUserAgentSpecifies the user agent name to be used by all HTTP clients.
LogDestinationSpecifies the debug log destination.
LogDetailsSpecifies the debug log details to dump.
LogFileSpecifies the debug log filename.
LogFiltersSpecifies the debug log filters.
LogFlushModeSpecifies the log flush mode.
LogLevelSpecifies the debug log level.
LogMaxEventCountSpecifies the maximum number of events to cache before further action is taken.
LogRotationModeSpecifies the log rotation mode.
MaxASN1BufferLengthSpecifies the maximal allowed length for ASN.1 primitive tag data.
MaxASN1TreeDepthSpecifies the maximal depth for processed ASN.1 trees.
OCSPHashAlgorithmSpecifies the hash algorithm to be used to identify certificates in OCSP requests.
UseOwnDNSResolverSpecifies whether the client components should use own DNS resolver.
UseSharedSystemStoragesSpecifies whether the validation engine should use a global per-process copy of the system certificate stores.
UseSystemOAEPAndPSSEnforces or disables the use of system-driven RSA OAEP and PSS computations.
UseSystemRandomEnables or disables the use of the OS PRNG.

Copyright (c) 2022 /n software inc. - All rights reserved.
SecureBlackbox 2020 .NET Edition - Version 20.0 [Build 8165]