SAMLWriter Component
Properties Methods Events Configuration Settings Errors
The SAMLWriter component offers SAML message generation functions.
Syntax
TsbxSAMLWriter
Remarks
SAMLWriter provides means of serialization of SAML entities into valid SAML protocol messages. Together with SAMLReader, this class provides fine-grained access to the composition of SAML requests, responses, assertions, and statements. You can use it as part of your SAML client or SAML server implementation for creating individual SAML entities.
SAMLReader and SAMLWriter are independent of SAML server controls that are also included in SecureBlackbox, and are aimed at scenarios that require lower-level access to SAML functionality than that provided by the server controls.
SAMLWriter can create the following kinds of SAML messages:
- AssertionIDRequest
- SubjectQuery
- AuthnQuery
- AttributeQuery
- AuthzDecisionQuery
- AuthnRequest
- ManageNameIDRequest
- LogoutRequest
- NameIDMappingRequest
- ArtifactResolve
- Response
Please find below a quick-and-dirty example of the use of SAMLWriter class for creating a signed AuthnRequest message:
Samlwriter writer = new Samlwriter();// configuring general message propertieswriter.Destination = "http://destination-url.com";writer.IssueInstant = DateTime.UtcNow.ToString("yyyy-MM-ddTHH:mm:ss.fffZ");writer.Issuer = "Value=https://issuer-url.com;Format=urn:oasis:names:tc:SAML:2.0:nameid-format:entity;IDType=Issuer";// configuring general AuthnRequest propertieswriter.AuthnRequest.IsPassive = false;writer.AuthnRequest.UseIsPassive = true;writer.AuthnRequest.ForceAuthn = true;writer.AuthnRequest.ProtocolBinding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";writer.AuthnRequest.AssertionConsumerServiceURL = "https://assertion-consumer-url.com";writer.AuthnRequest.AttributeConsumingServiceIndex = 1;writer.AuthnRequest.NameIDPolicyAllowCreate = false;writer.AuthnRequest.NameIDPolicyFormat = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent";writer.AuthnRequest.ConditionsNotBefore = DateTime.UtcNow.ToString("yyyy-MM-ddTHH:mm:ss.fffZ");writer.AuthnRequest.ConditionsNotOnOrAfter = DateTime.UtcNow.AddMinutes(30).ToString("yyyy-MM-ddTHH:mm:ss.fffZ");// adjusting request conditions if requiredSAMLAssertionCondition cond = new SAMLAssertionCondition();cond.ConditionType = SAMLConditionTypes.csctOneTimeUse;writer.AuthnRequestConditions.Add(cond);// configuring signing propertiesCertificate certificate = new Certificate("C:\\Certs\\samlCert.pfx", "password");writer.Sign = true;writer.SigningCertificate = certificate;// creating the SAML entity of the required typewriter.CreateNew((int)SamlwriterOutputTypes.cstyAuthnRequest);// adjusting low-level signature parameterswriter.Config("SigDigestMethod=http://www.w3.org/2001/04/xmlenc#sha256");writer.Config("SigMethod=http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"); // signing the request and serializing it to XMLstring request = writer.Save();<samlp:AuthnRequest xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="53GhrzQ5f89fu214ANAR" Version="2.0" IssueInstant="2021-12-15T10:39:31Z" Destination="http://destination-url.com" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://assertion-consumer-url.com" AttributeConsumingServiceIndex="1" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"> <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://issuer-url.com</saml:Issuer> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/> <ds:Reference URI="#53GhrzQ5f89fu214ANAR"> <ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>+xhhgXtwYN0/r9h7WAwg=</ds:DigestValue> </ds:Reference> </ds:SignedInfo> <ds:SignatureValue> jfYeIq/z8D1tJZYbVqDMoqKpdrfGMj8/zI7gbUsJbECAr00cN34md2QG0mo4cOx7pny+5 Tht7tUzqENHqcZdmlOcZc2JcJqokVxIcLEluFiWKlNjpexkXFQKzOC1peRfTZm8SQTqtP Cz8IknLUc6Scfml29PHmks1PxjJDteGb/+FggsZRTGZC3a05nvH3ayvHukPeHuHssx5dX nj0quT8salR6fdx6lAJo/AnDHzcfBNyxAMn+ebk5VOOgVD1L3PayvXib/maj8aVI2I5UT o4vmfybTWKzeS8DX9We7UV+4Xowwe647t1A912xLVub/e23A18Yf1V0PXC87kttTkA== </ds:SignatureValue> <ds:KeyInfo> <ds:X509Data><ds:X509Certificate> MIIEKDCCAxCgAwIBAgIFYA3A3gIwDQYJKoZIhvcNAQELBQAwfjELMAkGA1UEBhMCVVMxC zAJBgNVBAgTAk5DMRQwEgYDVQQHEwtDaGFwZWwgSGlsbDEiMCAGCSqGSIb3DQEJARMTc2 FsZXNAbnNvZnR3YXJlLmNvbTEoMCYGA1UEAxMfU2VjdXJlQmxhY2tib3ggRGVtbyBDZXJ 0aWZpY2F0ZTAeFw0xNzA5MDEwMDAwMDBaFw0yMjA5MDEwMDAwMDBaMH4xCzAJBgNVBAYT AlVTMQswCQYDVQQIEwJOQzEUMBIGA1UEBxMLQ2hhcGVsIEhpbGwxIjAgBgkqhkiG9w0BC QETE3NhbGVzQG5zb2Z0d2FyZS5jb20xKDAmBgNVBAMTH1NlY3VyZUJsYWNrYm94IERlbW 8gQ2VydGlmaWNhdGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCfAVIcq9o eoIbw56LsPjxWsX3YGkqasBQzgQymhfcDZeSvFKFis8iqArGLTUUWOaImO5t2UmjIa+4n YP39hb9Z1r0CMy53p83oYbbZZ7qMeji0pMAufJHqKCN8t2HNWf2HE8S9UOU7R/UHdrSAN JitBKV9lSG9f450yWoGNwt35ZCsOp0zqtCgvkEvteGsz01R5DDjOccs3QNu25K/Sf27KP CYabS6A1ehYNY/G32qoKNJhu3DN4bWje57gBWi9WSfQ3tZUOV5q2ozaNJA78Wl4fXC6RB CaBh0GOwXeyZoH13LJdn+lqlCSMz024ImG4yFQEENbWvE9Elku8RYTn73AgMBAAGjgaww gakwHwYDVR0jBBgwFoAUmt/L7GI1SH36Sp8EUBxTwuzSgqMwHQYDVR0OBBYEFJrfy+xiN Uh9+kqfBFAcU8Ls0oKjMA8GA1UdEwEB/wQFMAMBAf8wDwYDVR0PAQH/BAUDAwDuADBFBg NVHSUEPjA8BggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMDBggrBgEFBQcDBAYIKwY BBQUHAwgGCCsGAQUFBwMJMA0GCSqGSIb3DQEBCwUAA4IBAQBovHBbMsW/k/5iuLQQqsYS ng5X2iy1W+5BRb1hz0MGnHGLqJWy1ty5+bTo6g/zvT65dXIPIexLkInEenYSy75Lthr6a ewUcvwfl1TYXjWlMD5Nm5pM9As71+XsGSdYGXoKohbEzbT6RDByjwR+yxtatqko7e1Eg6 InNJRTRt7al/63FSPEgSCqOX6asDVDNZ83db0dOcoeaPEiDz3liE3+tYHtKXj5/qwTtYd aqBZxdJfuCKZveEFe1DO3/ayDvIvG9Eme+rEjntErF+Cw9a8ukesvDuT49cRE9oTs3O7f 6LUbhCv5zJN+dTFr75NSdWdp4yvn3nK3i2udeMnTWK0U </ds:X509Certificate></ds:X509Data> </ds:KeyInfo> </ds:Signature> <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/> <saml:Conditions NotBefore="2021-12-15T10:39:31Z" NotOnOrAfter="2021-12-15T11:09:31Z"><saml:OneTimeUse/></saml:Conditions></samlp:AuthnRequest>Property List
The following is the full list of the properties of the component with short descriptions. Click on the links for further details.
| AddXMLHeader | Controls the inclusion of an XML header in the message. |
| Artifact | Provides access to the Artifact element of the message. |
| ArtifactResolveQuery | Contains the artifact resolve query. |
| AssertionAttributes | Contains a list of assertion attributes. |
| AssertionConditions | Contains a list of assertion conditions. |
| AssertionCount | Returns the number of assertions in the message. |
| AssertionIDRequest | Contains the properties of AssertionIDRequest element. |
| AssertionInfo | Contains assertion information. |
| AssertionIssuer | Specifies the assertion issuer. |
| AssertionStatements | Contains assertion statements. |
| AssertionSubjectConfirmations | Provides access to assertion SubjectConfirmations list. |
| AssertionSubjectID | Specifies the assertion subject ID. |
| AttrQueryAttributes | Contains a list of attribute query attributes. |
| AuthnQuery | Provides access to the AuthnQuery SAML element. |
| AuthnRequest | Publishes the properties of AuthnRequest element. |
| AuthnRequestConditions | Contains a list of AuthnRequest conditions. |
| AuthnRequestScopingIDPList | Provides access to the list of scoping IDP eleements. |
| AuthzDecisionQuery | Provides access to AuthzDecisionQuery element. |
| Binding | Specifies the type of the binding to use. |
| Consent | Contains the Consent parameter of the request. |
| Destination | Contains the Destination parameter of the SAML object. |
| EncryptionCertificate | Sets the encryption certificate. |
| ID | The ID of the request. |
| InResponseTo | Contains the InResponseTo property of the SAML request. |
| IssueInstant | Contains request issuance timestamp. |
| Issuer | Sets the issuer of the message. |
| LogoutRequest | Contains the properties of SAML LogoutRequest element. |
| ManageNameIDRequest | Provides access to ManageNameIDRequest element. |
| NameIDMappingRequest | Publishes the properties of NameIDMappingRequest entity. |
| OutputType | Returns the SAML type of message being created. |
| POSTBinding | Exposes the POST binding properties. |
| Profile | Specifies a pre-defined profile to apply when creating the signature. |
| RedirectBinding | Publishes the redirect binding settings. |
| RedirectBindingCertificate | Contains a certificate to sign the redirect binding. |
| Response | Provides access to the SAML response object properties. |
| Sign | Specifies whether the created SAML message should be signed. |
| SigningCertificate | The certificate to be used for signing. |
| SigningChain | The signing certificate chain. |
| SubjectConfirmations | Provides access to the list of subject confirmation elements. |
| SubjectID | Sets the subject of the message. |
| Version | Specifies the protocol version of the SAML message. |
Method List
The following is the full list of the methods of the component with short descriptions. Click on the links for further details.
| AddAdviceAssertion | Adds an advice assertion to the message. |
| AddAssertion | Adds assertion to a SAML message. |
| ClearAssertion | Resets the contents of all assertion-related properties. |
| CompareIDs | Compares two SAML IDs. |
| Config | Sets or retrieves a configuration setting. |
| CreateNew | Creates a new SAML message with the given type. |
| GetIDProp | Returns an element of the SAML ID. |
| RemoveAdvice | Removes an advice from an assertion. |
| RemoveAdviceAssertion | Removes an advice from an assertion. |
| RemoveAllAssertions | Removes all assertions currently configured in the message. |
| RemoveAssertion | Removes an assertion from the message. |
| Save | Saves the configured message to a string. |
| SaveBytes | Saves the configured message to a byte array. |
| SaveFile | Saves the configured message to a file. |
| SaveStream | Saves the configured message to a stream. |
Event List
The following is the full list of the events fired by the component with short descriptions. Click on the links for further details.
| Error | Fires to report an error condition. |
| Notification | This event notifies the application about an underlying control flow event. |
Configuration Settings
The following is a list of configuration settings for the component with short descriptions. Click on the links for further details.
| IgnoreSystemTrust | Whether trusted Windows Certificate Stores should be treated as trusted. |
| SigAfterIssuer | Specifies whether to insert the signature after the issuer tag in the SAML document. |
| SigCanonicalizationMethod | The canonicalization method to use in the signature. |
| SigDigestMethod | The digest method to use. |
| SigMethod | The signature method to use. |
| TolerateMinorChainIssues | Whether to tolerate minor chain issues. |
| UseMicrosoftCTL | Enables or disables automatic use of Microsoft online certificate trust list. |
| UseSystemCertificates | Enables or disables the use of the system certificates. |
| CheckKeyIntegrityBeforeUse | Enables or disable private key integrity check before use. |
| CookieCaching | Specifies whether a cookie cache should be used for HTTP(S) transports. |
| Cookies | Gets or sets local cookies for the component (supported for HTTPClient, RESTClient and SOAPClient only). |
| DefDeriveKeyIterations | Specifies the default key derivation algorithm iteration count. |
| EnableClientSideSSLFFDHE | Enables or disables finite field DHE key exchange support in TLS clients. |
| GlobalCookies | Gets or sets global cookies for all the HTTP transports. |
| HttpUserAgent | Specifies the user agent name to be used by all HTTP clients. |
| LogDestination | Specifies the debug log destination. |
| LogDetails | Specifies the debug log details to dump. |
| LogFile | Specifies the debug log filename. |
| LogFilters | Specifies the debug log filters. |
| LogFlushMode | Specifies the log flush mode. |
| LogLevel | Specifies the debug log level. |
| LogMaxEventCount | Specifies the maximum number of events to cache before further action is taken. |
| LogRotationMode | Specifies the log rotation mode. |
| MaxASN1BufferLength | Specifies the maximal allowed length for ASN.1 primitive tag data. |
| MaxASN1TreeDepth | Specifies the maximal depth for processed ASN.1 trees. |
| OCSPHashAlgorithm | Specifies the hash algorithm to be used to identify certificates in OCSP requests. |
| UseOwnDNSResolver | Specifies whether the client components should use own DNS resolver. |
| UseSharedSystemStorages | Specifies whether the validation engine should use a global per-process copy of the system certificate stores. |
| UseSystemOAEPAndPSS | Enforces or disables the use of system-driven RSA OAEP and PSS computations. |
| UseSystemRandom | Enables or disables the use of the OS PRNG. |