SAMLReader Class
Properties Methods Events Configuration Settings Errors
The SAMLReader class offers SAML message processing functionality.
Syntax
secureblackbox.samlreader()
Remarks
SAMLReader provides means for processing of SAML protocol messages and extraction of their elements. Together with SAMLWriter it provides fine-grained access to the contents of SAML messages. You may consider using these classes if functionality offered by SAMLIdPServer and SAMLSPServer is too high a level for your usage scenario.
SAMLReader and SAMLWriter are independent of SAML server controls, and focus on scenarios that require lower-level access to SAML messaging.
SAMLReader can process the following types of SAML messages:
- AssertionIDRequest
- SubjectQuery
- AuthnQuery
- AttributeQuery
- AuthzDecisionQuery
- AuthnRequest
- ManageNameIDRequest
- LogoutRequest
- NameIDMappingRequest
- ArtifactResolve
- Response
Pass your SAML message to Open (or OpenStream) method. Upon processing, class will populate the elements of the message in the properties, such as InputType or Issuer. More complex elements, such as assertions, require pinning with PinAssertion method to be populated in the object properties.
The snippet below shows how to use SAMLReader to process a message of the AuthnRequest type created by the
matching SAMLReader example (or by any compatible SAML endpoint). The input SAML message has the following look:
<samlp:AuthnRequest xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="53GhrzQ5f89fu214ANAR" Version="2.0" IssueInstant="2021-12-15T10:39:31Z" Destination="http://destination-url.com" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://assertion-consumer-url.com" AttributeConsumingServiceIndex="1" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"> <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://issuer-url.com</saml:Issuer> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/> <ds:Reference URI="#53GhrzQ5f89fu214ANAR"> <ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>+xhhgXtwYN0/r9h7WAwg=</ds:DigestValue> </ds:Reference> </ds:SignedInfo> <ds:SignatureValue> jfYeIq/z8D1tJZYbVqDMoqKpdrfGMj8/zI7gbUsJbECAr00cN34md2QG0mo4cOx7pny+5 Tht7tUzqENHqcZdmlOcZc2JcJqokVxIcLEluFiWKlNjpexkXFQKzOC1peRfTZm8SQTqtP Cz8IknLUc6Scfml29PHmks1PxjJDteGb/+FggsZRTGZC3a05nvH3ayvHukPeHuHssx5dX nj0quT8salR6fdx6lAJo/AnDHzcfBNyxAMn+ebk5VOOgVD1L3PayvXib/maj8aVI2I5UT o4vmfybTWKzeS8DX9We7UV+4Xowwe647t1A912xLVub/e23A18Yf1V0PXC87kttTkA== </ds:SignatureValue> <ds:KeyInfo> <ds:X509Data><ds:X509Certificate> MIIEKDCCAxCgAwIBAgIFYA3A3gIwDQYJKoZIhvcNAQELBQAwfjELMAkGA1UEBhMCVVMxC zAJBgNVBAgTAk5DMRQwEgYDVQQHEwtDaGFwZWwgSGlsbDEiMCAGCSqGSIb3DQEJARMTc2 FsZXNAbnNvZnR3YXJlLmNvbTEoMCYGA1UEAxMfU2VjdXJlQmxhY2tib3ggRGVtbyBDZXJ 0aWZpY2F0ZTAeFw0xNzA5MDEwMDAwMDBaFw0yMjA5MDEwMDAwMDBaMH4xCzAJBgNVBAYT AlVTMQswCQYDVQQIEwJOQzEUMBIGA1UEBxMLQ2hhcGVsIEhpbGwxIjAgBgkqhkiG9w0BC QETE3NhbGVzQG5zb2Z0d2FyZS5jb20xKDAmBgNVBAMTH1NlY3VyZUJsYWNrYm94IERlbW 8gQ2VydGlmaWNhdGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCfAVIcq9o eoIbw56LsPjxWsX3YGkqasBQzgQymhfcDZeSvFKFis8iqArGLTUUWOaImO5t2UmjIa+4n YP39hb9Z1r0CMy53p83oYbbZZ7qMeji0pMAufJHqKCN8t2HNWf2HE8S9UOU7R/UHdrSAN JitBKV9lSG9f450yWoGNwt35ZCsOp0zqtCgvkEvteGsz01R5DDjOccs3QNu25K/Sf27KP CYabS6A1ehYNY/G32qoKNJhu3DN4bWje57gBWi9WSfQ3tZUOV5q2ozaNJA78Wl4fXC6RB CaBh0GOwXeyZoH13LJdn+lqlCSMz024ImG4yFQEENbWvE9Elku8RYTn73AgMBAAGjgaww gakwHwYDVR0jBBgwFoAUmt/L7GI1SH36Sp8EUBxTwuzSgqMwHQYDVR0OBBYEFJrfy+xiN Uh9+kqfBFAcU8Ls0oKjMA8GA1UdEwEB/wQFMAMBAf8wDwYDVR0PAQH/BAUDAwDuADBFBg NVHSUEPjA8BggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMDBggrBgEFBQcDBAYIKwY BBQUHAwgGCCsGAQUFBwMJMA0GCSqGSIb3DQEBCwUAA4IBAQBovHBbMsW/k/5iuLQQqsYS ng5X2iy1W+5BRb1hz0MGnHGLqJWy1ty5+bTo6g/zvT65dXIPIexLkInEenYSy75Lthr6a ewUcvwfl1TYXjWlMD5Nm5pM9As71+XsGSdYGXoKohbEzbT6RDByjwR+yxtatqko7e1Eg6 InNJRTRt7al/63FSPEgSCqOX6asDVDNZ83db0dOcoeaPEiDz3liE3+tYHtKXj5/qwTtYd aqBZxdJfuCKZveEFe1DO3/ayDvIvG9Eme+rEjntErF+Cw9a8ukesvDuT49cRE9oTs3O7f 6LUbhCv5zJN+dTFr75NSdWdp4yvn3nK3i2udeMnTWK0U </ds:X509Certificate></ds:X509Data> </ds:KeyInfo> </ds:Signature> <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/> <saml:Conditions NotBefore="2021-12-15T10:39:31Z" NotOnOrAfter="2021-12-15T11:09:31Z"><saml:OneTimeUse/></saml:Conditions> </samlp:AuthnRequest>You can process this message and access its properties with the following code:
Samlreader reader = new Samlreader(); reader.ValidateSignatures = true; reader.Open(req); Log("SAML document loaded. The message is of the " + reader.InputTypeString + " type, and was issued by " + reader.Issuer + " at " + reader.IssueInstant + "."); if (reader.InputType == SamlreaderInputTypes.cstyAuthnRequest) { Log("AuthnRequest.ConsumerServiceURL: " + reader.AuthnRequest.AssertionConsumerServiceURL); Log("AuthnRequest.ProtocolBinding: " + reader.AuthnRequest.ProtocolBinding); Log("AuthnRequest.Conditions.NotBefore: " + reader.AuthnRequest.ConditionsNotBefore); Log("AuthnRequest.Conditions.NotAfter: " + reader.AuthnRequest.ConditionsNotOnOrAfter); } if (reader.Signed) { Log("The message was signed by " + reader.SigningCertificate.SubjectRDN); Log("Signature validity: " + reader.SignatureValidationResult.ToString()); }
Property List
The following is the full list of the properties of the class with short descriptions. Click on the links for further details.
ArtifactEndpointIndex | An accessor to the EndpointIndex entry of the artifact. |
ArtifactMessageHandle | An accessor to the MessageHandle property of the artifact. |
ArtifactRemainingArtifact | Returns the contents of the artifact. |
ArtifactSourceID | An accessor to the SourceID property of the artifact. |
ArtifactTypeCode | The TypeCode property of the artifact. |
ArtifactURI | An accessor to the URI property of the artifact. |
ArtifactResolveQuery | Returns the content of the ArtifactResolve query. |
AssertionCount | Returns the number of assertions in the SAML message. |
AssertionIDRequestReferences | Contains the References entry of the SAML assertion ID request. |
AttrQueryAttrCount | The number of records in the AttrQueryAttr arrays. |
AttrQueryAttrFriendlyName | Specifies the friendly name of the attribute Use this property to access or set the friendly name of a SAML attribute (e. |
AttrQueryAttrName | Specifies the name of the attribute. |
AttrQueryAttrNameFormat | Indicates the format used to reference the attribute. |
AttrQueryAttrStatementIndex | Contains the index of the statement the attribute corresponds to. |
AttrQueryAttrValues | Contains a list of attribute values. |
AuthnQueryComparison | Specifies the authentication context comparison method. |
AuthnQueryContextClassRefs | Specifies the context class reference. |
AuthnQueryRefType | Specifies the context reference type. |
AuthnQuerySessionIndex | Specifies the index of the session to the authentication entity. |
AuthnRequestAssertionConsumerServiceIndex | Specifies the assertion consumer service index. |
AuthnRequestAssertionConsumerServiceURL | Specifies the assertion consumer service URL. |
AuthnRequestAttributeConsumingServiceIndex | Specifies the attribute consuming service index. |
AuthnRequestConditionsNotBefore | Specifies the NotBefore condition of the request. |
AuthnRequestConditionsNotOnOrAfter | Provides access to the NotOnOrAfter condition of the request. |
AuthnRequestContextClassRefs | Provides access to the authentication context class references. |
AuthnRequestContextComparison | Specifies the AuthnContext comparison method. |
AuthnRequestContextRefType | Specifies the context reference type. |
AuthnRequestForceAuthn | Corresponds to the ForceAuthn parameter of the request. |
AuthnRequestIsPassive | Maps to the IsPassive parameter of the request. |
AuthnRequestNameIDPolicyAllowCreate | Matches the AllowCreate attribute of NameIDPolicy element of the request. |
AuthnRequestNameIDPolicyFormat | Matches to the Format attribute of the NameIDPolicy element of the request. |
AuthnRequestNameIDPolicySPNameQualifier | Matches to the SP name qualifier attribute of the request. |
AuthnRequestNameIDPolicyUseAllowCreate | Controls inclusion of AllowCreate attribute in the request. |
AuthnRequestProtocolBinding | Specifies the protocol binding to be requested in the authentication request. |
AuthnRequestProviderName | Specifies the name of the requestor. |
AuthnRequestScopingIDPListGetComplete | Matches the GetComplete element of the IDPList entry of the Scoping object. |
AuthnRequestScopingProxyCount | The maximum number of proxies on the way between the requestor and the provider. |
AuthnRequestScopingRequesterIDs | A collection of requestor IDs on whose behalf the request is being sent. |
AuthnRequestUseForceAuthn | Controls inclusion of ForceAuthn attribute in the request. |
AuthnRequestUseIsPassive | Controls inclusion of IsPassive attribute in the request. |
AuthnRequestConditionCount | The number of records in the AuthnRequestCondition arrays. |
AuthnRequestConditionAudienceList | An accessor to the Audience list parameter of an audience restriction condition. |
AuthnRequestConditionConditionType | Specifies a type of the condition object. |
AuthnRequestConditionProxyRestrictionCount | An accessor to the proxy restriction count element of the condition. |
AuthnRequestScopingIDPCount | The number of records in the AuthnRequestScopingIDP arrays. |
AuthnRequestScopingIDPLoc | Contains the value of the Loc attribute. |
AuthnRequestScopingIDPName | Contains the name of the IdP provider. |
AuthnRequestScopingIDPProviderID | Contains the provider ID. |
AuthzDecisionQueryActions | Specifies the list of actions included in the query. |
AuthzDecisionQueryResource | Matches the Resource element of the query. |
Binding | Returns the SAML message binding type. |
BlockedCertCount | The number of records in the BlockedCert arrays. |
BlockedCertBytes | Returns raw certificate data in DER format. |
BlockedCertHandle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
ChainValidationDetails | The details of a certificate chain validation outcome. |
ChainValidationResult | The general outcome of a certificate chain validation routine. Use ChainValidationDetails to get information about the reasons that contributed to the validation result. |
Consent | Returns the Consent parameter of the SAML message. |
DecryptionCertificateBytes | Returns raw certificate data in DER format. |
DecryptionCertificateHandle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
Destination | Returns the Destination parameter of the SAML message. |
ID | Returns the ID of the processed message. |
IgnoreChainValidationErrors | Makes the class tolerant to chain validation errors. |
InputType | Returns the type of the processed message. |
InputTypeString | Returns the type of the processed message, as an original string. |
InResponseTo | Returns the in-response-to parameter of the message. |
IssueInstant | Returns the issue time of the message. |
Issuer | Returns the issuer of the message. |
KnownCertCount | The number of records in the KnownCert arrays. |
KnownCertBytes | Returns raw certificate data in DER format. |
KnownCertHandle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
KnownCRLCount | The number of records in the KnownCRL arrays. |
KnownCRLBytes | Returns raw CRL data in DER format. |
KnownCRLHandle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
KnownOCSPCount | The number of records in the KnownOCSP arrays. |
KnownOCSPBytes | Buffer containing raw OCSP response data. |
KnownOCSPHandle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
LogoutRequestNameID | Contains the value of the NameID parameter. |
LogoutRequestNotOnOrAfter | Contains the value of the NotOnOrAfter parameter. |
LogoutRequestReason | Contains the value of the Reason parameter. |
LogoutRequestSessionIndexes | Contains the list of session indices. |
ManageNameIDRequestNameID | Contains the value of the NameID parameter of the request. |
ManageNameIDRequestNewEncryptedID | Contains the value of the NewEncryptedID parameter of the request. |
ManageNameIDRequestNewID | Contains the value of the NewID parameter. |
ManageNameIDRequestTerminate | Contains the value of the Terminate parameter of the request. |
NameIDMappingRequestNameID | An accessor to the NameID parameter of the request. |
NameIDMappingRequestNameIDPolicyAllowCreate | Contains the value of AllowCreate parameter of the NameIDPolicy object. |
NameIDMappingRequestNameIDPolicyFormat | Specifies the format of the NameIDPolicy element. |
NameIDMappingRequestNameIDPolicySPNameQualifier | Contains the SPNameQualifier parameter of the NameIDPolicy element. |
NameIDMappingRequestNameIDPolicyUseAllowCreate | Controls inclusion of UseAllow modifier in the NameIDPolicy object. |
OfflineMode | Switches the class to the offline mode. |
PinnedAssertionAttrCount | The number of records in the PinnedAssertionAttr arrays. |
PinnedAssertionAttrFriendlyName | Specifies the friendly name of the attribute Use this property to access or set the friendly name of a SAML attribute (e. |
PinnedAssertionAttrName | Specifies the name of the attribute. |
PinnedAssertionAttrNameFormat | Indicates the format used to reference the attribute. |
PinnedAssertionAttrStatementIndex | Contains the index of the statement the attribute corresponds to. |
PinnedAssertionAttrValues | Contains a list of attribute values. |
PinnedAssertionConditionCount | The number of records in the PinnedAssertionCondition arrays. |
PinnedAssertionConditionAudienceList | An accessor to the Audience list parameter of an audience restriction condition. |
PinnedAssertionConditionConditionType | Specifies a type of the condition object. |
PinnedAssertionConditionProxyRestrictionCount | An accessor to the proxy restriction count element of the condition. |
PinnedAssertionInfoAdviceAssertionCount | Contains the number of advice assertions. |
PinnedAssertionInfoAssertionType | Specifies the type of the assertion. |
PinnedAssertionInfoChainValidationDetails | The details of a certificate chain validation outcome. |
PinnedAssertionInfoChainValidationResult | The outcome of a certificate chain validation routine. |
PinnedAssertionInfoConditionsNotBefore | Represents the Conditions. |
PinnedAssertionInfoConditionsNotOnOrAfter | Represents the Conditions. |
PinnedAssertionInfoEncryptedContent | Represents the encrypted assertion content. |
PinnedAssertionInfoID | Represents the ID of the assertion. |
PinnedAssertionInfoIDRef | Represents an ID reference value. |
PinnedAssertionInfoIssueInstant | Contains the assertion issuance time stamp. |
PinnedAssertionInfoSignatureValidationResult | The outcome of the cryptographic signature validation. |
PinnedAssertionInfoSigned | Specifies whether the assertion is signed. |
PinnedAssertionInfoURIRef | Represents an URI reference value. |
PinnedAssertionInfoValidationLog | Contains the signing certificate's chain validation log. |
PinnedAssertionInfoVersion | Specifies the SAML protocol version used. |
PinnedAssertionIssuer | Returns the pinned assertion issuer. |
PinnedAssertionStatementCount | The number of records in the PinnedAssertionStatement arrays. |
PinnedAssertionStatementAttributes | Contains a list of statement attribute names. |
PinnedAssertionStatementAuthnContextAuthenticatingAuthorities | Contains the list of authenticating authorities. |
PinnedAssertionStatementAuthnContextChoice | Specifies the authentication context choice variant. |
PinnedAssertionStatementAuthnContextClassRef | Indicates the authentication contexts class reference. |
PinnedAssertionStatementAuthnContextDecl | Specifies the authentication contexts declaration. |
PinnedAssertionStatementAuthnContextDeclRef | Specifies the authentication contexts declaration reference. |
PinnedAssertionStatementAuthnInstant | Specifies the authentication event timestamp. |
PinnedAssertionStatementAuthnSessionIndex | Contains the authentication session index. |
PinnedAssertionStatementAuthnSessionNotOnOrAfter | Maps to the SessionNotOnOrAfter parameter of the authentication statement. |
PinnedAssertionStatementAuthnSubjectLocalityAddress | Specifies the authentication subjects address. |
PinnedAssertionStatementAuthnSubjectLocalityDNSName | Maps to the authentication subjects DNS name parameter. |
PinnedAssertionStatementAuthzActions | Provides access to the list of actions of the authorization statement. |
PinnedAssertionStatementAuthzDecision | Specifies the authorization decision. |
PinnedAssertionStatementAuthzDecisionEvidence | Manages the authorization decision statement evidence parameter. |
PinnedAssertionStatementAuthzDecisionResource | Specifies the authorization decision statement resource parameter. |
PinnedAssertionStatementStatementType | Specifies the assertion statement type. |
PinnedAssertionSubjectConfirmationCount | The number of records in the PinnedAssertionSubjectConfirmation arrays. |
PinnedAssertionSubjectConfirmationDataAddress | Contains the address enabled for presenting assertions. |
PinnedAssertionSubjectConfirmationDataInResponseTo | The ID of the SAML message in response to which the assertion is issued. |
PinnedAssertionSubjectConfirmationDataNotBefore | Time moment before which the subject cannot be confirmed. |
PinnedAssertionSubjectConfirmationDataNotOnOrAfter | Limits the time until which the subject can be confirmed. |
PinnedAssertionSubjectConfirmationDataRecipient | The URI of the entity or the location of the resource to which the assertion should be presented. |
PinnedAssertionSubjectConfirmationDataType | The type of data contained in the confirmation. |
PinnedAssertionSubjectConfirmationID | The identifier of the entity which can satisfy the subject confirmation requirements. |
PinnedAssertionSubjectConfirmationMethod | Specifies the mechanism to be used to confirm the subject. |
PinnedAssertionSubjectID | Returns the pinned assertion subject. |
POSTBindingBody | Contains the form body. |
POSTBindingFormTemplate | Contains the XHTML form template returned by the service provider. |
POSTBindingMode | Specifies whether binding is applied on a server, or on a client side. |
POSTBindingRelayState | Contains the value of the RelayState parameter of POST binding mechanism. |
POSTBindingURL | Contains the URL of POST binding mechanism. |
Profile | Specifies a pre-defined profile to apply when creating the signature. |
ProxyAddress | The IP address of the proxy server. |
ProxyAuthentication | The authentication type used by the proxy server. |
ProxyPassword | The password to authenticate to the proxy server. |
ProxyPort | The port on the proxy server to connect to. |
ProxyProxyType | The type of the proxy server. |
ProxyRequestHeaders | Contains HTTP request headers for WebTunnel and HTTP proxy. |
ProxyResponseBody | Contains the HTTP or HTTPS (WebTunnel) proxy response body. |
ProxyResponseHeaders | Contains response headers received from an HTTP or HTTPS (WebTunnel) proxy server. |
ProxyUseIPv6 | Specifies whether IPv6 should be used when connecting through the proxy. |
ProxyUseProxy | Enables or disables proxy-driven connection. |
ProxyUsername | Specifies the username credential for proxy authentication. |
RedirectBindingEncoding | Specifies the message encoding. |
RedirectBindingForceSign | Enforces a signature over all outgoing messages. |
RedirectBindingRelayState | Contains the RelayState parameter of the binding. |
RedirectBindingSign | Specifies whether to sign generated messages. |
RedirectBindingSignatureAlgorithm | Contains the signature algorithm. |
RedirectBindingURL | Contains the URL of the request query. |
RedirectBindingVerifySignatures | Instructs the class whether to verify incoming signatures. |
RedirectBindingCertBytes | Returns raw certificate data in DER format. |
RedirectBindingCertHandle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
ResponseNameID | Contains the NameID parameter of a NameIDMapping response. |
ResponseOptionalElement | An optional message element to be returned with the response. |
ResponseResponseType | Contains the type of the response. |
ResponseStatusCodeSubValue | The value of the nested StatusCode. |
ResponseStatusCodeValue | Contains the status code value. |
ResponseStatusDetail | Contains additional information on the status of the request. |
ResponseStatusMessage | Contains a status message (optional). |
SignatureValidationResult | Contains the signature validation result. |
Signed | Returns true it the message is signed. |
SigningCertBytes | Returns raw certificate data in DER format. |
SigningCertCA | Indicates whether the certificate has a CA capability (a setting in BasicConstraints extension). |
SigningCertCAKeyID | A unique identifier (fingerprint) of the CA certificate's private key. |
SigningCertCRLDistributionPoints | Locations of the CRL (Certificate Revocation List) distribution points used to check this certificate's validity. |
SigningCertCurve | Specifies the elliptic curve of the EC public key. |
SigningCertFingerprint | Contains the fingerprint (a hash imprint) of this certificate. |
SigningCertFriendlyName | Contains an associated alias (friendly name) of the certificate. |
SigningCertHandle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
SigningCertHashAlgorithm | Specifies the hash algorithm to be used in the operations on the certificate (such as key signing) SB_HASH_ALGORITHM_SHA1 SHA1 SB_HASH_ALGORITHM_SHA224 SHA224 SB_HASH_ALGORITHM_SHA256 SHA256 SB_HASH_ALGORITHM_SHA384 SHA384 SB_HASH_ALGORITHM_SHA512 SHA512 SB_HASH_ALGORITHM_MD2 MD2 SB_HASH_ALGORITHM_MD4 MD4 SB_HASH_ALGORITHM_MD5 MD5 SB_HASH_ALGORITHM_RIPEMD160 RIPEMD160 SB_HASH_ALGORITHM_CRC32 CRC32 SB_HASH_ALGORITHM_SSL3 SSL3 SB_HASH_ALGORITHM_GOST_R3411_1994 GOST1994 SB_HASH_ALGORITHM_WHIRLPOOL WHIRLPOOL SB_HASH_ALGORITHM_POLY1305 POLY1305 SB_HASH_ALGORITHM_SHA3_224 SHA3_224 SB_HASH_ALGORITHM_SHA3_256 SHA3_256 SB_HASH_ALGORITHM_SHA3_384 SHA3_384 SB_HASH_ALGORITHM_SHA3_512 SHA3_512 SB_HASH_ALGORITHM_BLAKE2S_128 BLAKE2S_128 SB_HASH_ALGORITHM_BLAKE2S_160 BLAKE2S_160 SB_HASH_ALGORITHM_BLAKE2S_224 BLAKE2S_224 SB_HASH_ALGORITHM_BLAKE2S_256 BLAKE2S_256 SB_HASH_ALGORITHM_BLAKE2B_160 BLAKE2B_160 SB_HASH_ALGORITHM_BLAKE2B_256 BLAKE2B_256 SB_HASH_ALGORITHM_BLAKE2B_384 BLAKE2B_384 SB_HASH_ALGORITHM_BLAKE2B_512 BLAKE2B_512 SB_HASH_ALGORITHM_SHAKE_128 SHAKE_128 SB_HASH_ALGORITHM_SHAKE_256 SHAKE_256 SB_HASH_ALGORITHM_SHAKE_128_LEN SHAKE_128_LEN SB_HASH_ALGORITHM_SHAKE_256_LEN SHAKE_256_LEN . |
SigningCertIssuer | The common name of the certificate issuer (CA), typically a company name. |
SigningCertIssuerRDN | A collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate issuer. |
SigningCertKeyAlgorithm | Specifies the public key algorithm of this certificate. |
SigningCertKeyBits | Returns the length of the public key. |
SigningCertKeyFingerprint | Returns a fingerprint of the public key contained in the certificate. |
SigningCertKeyUsage | Indicates the purposes of the key contained in the certificate, in the form of an OR'ed flag set. |
SigningCertKeyValid | Returns True if the certificate's key is cryptographically valid, and False otherwise. |
SigningCertOCSPLocations | Locations of OCSP (Online Certificate Status Protocol) services that can be used to check this certificate's validity, as recorded by the CA. |
SigningCertPolicyIDs | Contains identifiers (OIDs) of the applicable certificate policies. |
SigningCertPublicKeyBytes | Contains the certificate's public key in DER format. |
SigningCertSelfSigned | Indicates whether the certificate is self-signed (root) or signed by an external CA. |
SigningCertSerialNumber | Returns the certificate's serial number. |
SigningCertSigAlgorithm | Indicates the algorithm that was used by the CA to sign this certificate. |
SigningCertSubject | The common name of the certificate holder, typically an individual's name, a URL, an e-mail address, or a company name. |
SigningCertSubjectKeyID | Contains a unique identifier (fingerprint) of the certificate's private key. |
SigningCertSubjectRDN | A collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate holder (subject). |
SigningCertValidFrom | The time point at which the certificate becomes valid, in UTC. |
SigningCertValidTo | The time point at which the certificate expires, in UTC. |
SocketDNSMode | Selects the DNS resolver to use: the class's (secure) built-in one, or the one provided by the system. |
SocketDNSPort | Specifies the port number to be used for sending queries to the DNS server. |
SocketDNSQueryTimeout | The timeout (in milliseconds) for each DNS query. |
SocketDNSServers | The addresses of DNS servers to use for address resolution, separated by commas or semicolons. |
SocketDNSTotalTimeout | The timeout (in milliseconds) for the whole resolution process. |
SocketIncomingSpeedLimit | The maximum number of bytes to read from the socket, per second. |
SocketLocalAddress | The local network interface to bind the socket to. |
SocketLocalPort | The local port number to bind the socket to. |
SocketOutgoingSpeedLimit | The maximum number of bytes to write to the socket, per second. |
SocketTimeout | The maximum period of waiting, in milliseconds, after which the socket operation is considered unsuccessful. |
SocketUseIPv6 | Enables or disables IP protocol version 6. |
SubjectConfirmationCount | The number of records in the SubjectConfirmation arrays. |
SubjectConfirmationDataAddress | Contains the address enabled for presenting assertions. |
SubjectConfirmationDataInResponseTo | The ID of the SAML message in response to which the assertion is issued. |
SubjectConfirmationDataNotBefore | Time moment before which the subject cannot be confirmed. |
SubjectConfirmationDataNotOnOrAfter | Limits the time until which the subject can be confirmed. |
SubjectConfirmationDataRecipient | The URI of the entity or the location of the resource to which the assertion should be presented. |
SubjectConfirmationDataType | The type of data contained in the confirmation. |
SubjectConfirmationID | The identifier of the entity which can satisfy the subject confirmation requirements. |
SubjectConfirmationMethod | Specifies the mechanism to be used to confirm the subject. |
SubjectID | Returns the subject of the message. |
TLSAutoValidateCertificates | Specifies whether server-side TLS certificates should be validated automatically using internal validation rules. |
TLSBaseConfiguration | Selects the base configuration for the TLS settings. |
TLSCiphersuites | A list of ciphersuites separated with commas or semicolons. |
TLSECCurves | Defines the elliptic curves to enable. |
TLSForceResumeIfDestinationChanges | Whether to force TLS session resumption when the destination address changes. |
TLSPreSharedIdentity | Defines the identity used when the PSK (Pre-Shared Key) key-exchange mechanism is negotiated. |
TLSPreSharedKey | Contains the pre-shared for the PSK (Pre-Shared Key) key-exchange mechanism, encoded with base16. |
TLSPreSharedKeyCiphersuite | Defines the ciphersuite used for PSK (Pre-Shared Key) negotiation. |
TLSRenegotiationAttackPreventionMode | Selects renegotiation attack prevention mechanism. |
TLSRevocationCheck | Specifies the kind(s) of revocation check to perform. |
TLSSSLOptions | Various SSL (TLS) protocol options, set of cssloExpectShutdownMessage 0x001 Wait for the close-notify message when shutting down the connection cssloOpenSSLDTLSWorkaround 0x002 (DEPRECATED) Use a DTLS version workaround when talking to very old OpenSSL versions cssloDisableKexLengthAlignment 0x004 Do not align the client-side PMS by the RSA modulus size. |
TLSTLSMode | Specifies the TLS mode to use. |
TLSUseExtendedMasterSecret | Enables Extended Master Secret Extension, as defined in RFC 7627. |
TLSUseSessionResumption | Enables or disables TLS session resumption capability. |
TLSVersions | Th SSL/TLS versions to enable by default. |
TrustedCertCount | The number of records in the TrustedCert arrays. |
TrustedCertBytes | Returns raw certificate data in DER format. |
TrustedCertHandle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
UseBinding | Enables or disables automated binding processing. |
ValidateSignatures | Enables or disables automated signature validation. |
ValidationLog | Contains the complete log of the certificate validation routine. |
ValidationMoment | The time point at which chain validity is to be established. |
Version | Returns SAML content version string. |
Method List
The following is the full list of the methods of the class with short descriptions. Click on the links for further details.
CompareIDs | Compares two SAML IDs. |
Config | Sets or retrieves a configuration setting. |
GetIDProp | Extracts a specific property from a SAML ID. |
Open | Opens a SAML entity. |
OpenBytes | Opens a SAML entity. |
OpenFile | Opens a SAML entity. |
PinAdviceAssertion | Pins advice assertion by propagating it in PinnedAssertionXXX properties. |
PinAssertion | Pins assertion by propagating it in PinnedAssertionXXX properties. |
Event List
The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.
Error | Fires to report an error condition. |
Notification | This event notifies the application about an underlying control flow event. |
SignatureFound | Signifies the start of signature validation. |
SignatureValidated | Reports the signature validation result. |
Configuration Settings
The following is a list of configuration settings for the class with short descriptions. Click on the links for further details.
IgnoreSystemTrust | Whether trusted Windows Certificate Stores should be treated as trusted. |
TolerateMinorChainIssues | Whether to tolerate minor chain issues. |
UseMicrosoftCTL | Enables or disables automatic use of Microsoft online certificate trust list. |
UseSystemCertificates | Enables or disables the use of the system certificates. |
CheckKeyIntegrityBeforeUse | Enables or disable private key integrity check before use. |
CookieCaching | Specifies whether a cookie cache should be used for HTTP(S) transports. |
Cookies | Gets or sets local cookies for the class (supported for HTTPClient, RESTClient and SOAPClient only). |
DefDeriveKeyIterations | Specifies the default key derivation algorithm iteration count. |
EnableClientSideSSLFFDHE | Enables or disables finite field DHE key exchange support in TLS clients. |
GlobalCookies | Gets or sets global cookies for all the HTTP transports. |
HttpUserAgent | Specifies the user agent name to be used by all HTTP clients. |
LogDestination | Specifies the debug log destination. |
LogDetails | Specifies the debug log details to dump. |
LogFile | Specifies the debug log filename. |
LogFilters | Specifies the debug log filters. |
LogFlushMode | Specifies the log flush mode. |
LogLevel | Specifies the debug log level. |
LogMaxEventCount | Specifies the maximum number of events to cache before further action is taken. |
LogRotationMode | Specifies the log rotation mode. |
MaxASN1BufferLength | Specifies the maximal allowed length for ASN.1 primitive tag data. |
MaxASN1TreeDepth | Specifies the maximal depth for processed ASN.1 trees. |
OCSPHashAlgorithm | Specifies the hash algorithm to be used to identify certificates in OCSP requests. |
UseOwnDNSResolver | Specifies whether the client classes should use own DNS resolver. |
UseSharedSystemStorages | Specifies whether the validation engine should use a global per-process copy of the system certificate stores. |
UseSystemOAEPAndPSS | Enforces or disables the use of system-driven RSA OAEP and PSS computations. |
UseSystemRandom | Enables or disables the use of the OS PRNG. |