SAMLReader Class

Properties Methods Events Configuration Settings Errors

The SAMLReader class offers SAML message processing functionality.

Syntax

class secureblackbox.SAMLReader

Remarks

SAMLReader provides means for processing of SAML protocol messages and extraction of their elements. Together with SAMLWriter it provides fine-grained access to the contents of SAML messages. You may consider using these classes if functionality offered by SAMLIdPServer and SAMLSPServer is too high a level for your usage scenario.

SAMLReader and SAMLWriter are independent of SAML server controls, and focus on scenarios that require lower-level access to SAML messaging.

SAMLReader can process the following types of SAML messages:

AssertionIDRequest
SubjectQuery
AuthnQuery
AttributeQuery
AuthzDecisionQuery
AuthnRequest
ManageNameIDRequest
LogoutRequest
NameIDMappingRequest
ArtifactResolve
Response

Pass your SAML message to open (or open_stream) method. Upon processing, class will populate the elements of the message in the properties, such as input_type or issuer. More complex elements, such as assertions, require pinning with pin_assertion method to be populated in the object properties.

The snippet below shows how to use SAMLReader to process a message of the AuthnRequest type created by the matching SAMLReader example (or by any compatible SAML endpoint). The input SAML message has the following look:

  <samlp:AuthnRequest 
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="53GhrzQ5f89fu214ANAR" Version="2.0" 
    IssueInstant="2021-12-15T10:39:31Z" Destination="http://destination-url.com" IsPassive="false" 
    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
    AssertionConsumerServiceURL="https://assertion-consumer-url.com" AttributeConsumingServiceIndex="1" 
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://issuer-url.com</saml:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
      <ds:SignedInfo>
        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
        <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
        <ds:Reference URI="#53GhrzQ5f89fu214ANAR">
          <ds:Transforms>
            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
          </ds:Transforms>
          <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>+xhhgXtwYN0/r9h7WAwg=</ds:DigestValue>
        </ds:Reference>
      </ds:SignedInfo>
      <ds:SignatureValue>
        jfYeIq/z8D1tJZYbVqDMoqKpdrfGMj8/zI7gbUsJbECAr00cN34md2QG0mo4cOx7pny+5
        Tht7tUzqENHqcZdmlOcZc2JcJqokVxIcLEluFiWKlNjpexkXFQKzOC1peRfTZm8SQTqtP
        Cz8IknLUc6Scfml29PHmks1PxjJDteGb/+FggsZRTGZC3a05nvH3ayvHukPeHuHssx5dX
        nj0quT8salR6fdx6lAJo/AnDHzcfBNyxAMn+ebk5VOOgVD1L3PayvXib/maj8aVI2I5UT
        o4vmfybTWKzeS8DX9We7UV+4Xowwe647t1A912xLVub/e23A18Yf1V0PXC87kttTkA==
      </ds:SignatureValue>
      <ds:KeyInfo>
        <ds:X509Data><ds:X509Certificate>
          MIIEKDCCAxCgAwIBAgIFYA3A3gIwDQYJKoZIhvcNAQELBQAwfjELMAkGA1UEBhMCVVMxC
          zAJBgNVBAgTAk5DMRQwEgYDVQQHEwtDaGFwZWwgSGlsbDEiMCAGCSqGSIb3DQEJARMTc2
          FsZXNAbnNvZnR3YXJlLmNvbTEoMCYGA1UEAxMfU2VjdXJlQmxhY2tib3ggRGVtbyBDZXJ
          0aWZpY2F0ZTAeFw0xNzA5MDEwMDAwMDBaFw0yMjA5MDEwMDAwMDBaMH4xCzAJBgNVBAYT
          AlVTMQswCQYDVQQIEwJOQzEUMBIGA1UEBxMLQ2hhcGVsIEhpbGwxIjAgBgkqhkiG9w0BC
          QETE3NhbGVzQG5zb2Z0d2FyZS5jb20xKDAmBgNVBAMTH1NlY3VyZUJsYWNrYm94IERlbW
          8gQ2VydGlmaWNhdGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCfAVIcq9o
          eoIbw56LsPjxWsX3YGkqasBQzgQymhfcDZeSvFKFis8iqArGLTUUWOaImO5t2UmjIa+4n
          YP39hb9Z1r0CMy53p83oYbbZZ7qMeji0pMAufJHqKCN8t2HNWf2HE8S9UOU7R/UHdrSAN
          JitBKV9lSG9f450yWoGNwt35ZCsOp0zqtCgvkEvteGsz01R5DDjOccs3QNu25K/Sf27KP
          CYabS6A1ehYNY/G32qoKNJhu3DN4bWje57gBWi9WSfQ3tZUOV5q2ozaNJA78Wl4fXC6RB
          CaBh0GOwXeyZoH13LJdn+lqlCSMz024ImG4yFQEENbWvE9Elku8RYTn73AgMBAAGjgaww
          gakwHwYDVR0jBBgwFoAUmt/L7GI1SH36Sp8EUBxTwuzSgqMwHQYDVR0OBBYEFJrfy+xiN
          Uh9+kqfBFAcU8Ls0oKjMA8GA1UdEwEB/wQFMAMBAf8wDwYDVR0PAQH/BAUDAwDuADBFBg
          NVHSUEPjA8BggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMDBggrBgEFBQcDBAYIKwY
          BBQUHAwgGCCsGAQUFBwMJMA0GCSqGSIb3DQEBCwUAA4IBAQBovHBbMsW/k/5iuLQQqsYS
          ng5X2iy1W+5BRb1hz0MGnHGLqJWy1ty5+bTo6g/zvT65dXIPIexLkInEenYSy75Lthr6a
          ewUcvwfl1TYXjWlMD5Nm5pM9As71+XsGSdYGXoKohbEzbT6RDByjwR+yxtatqko7e1Eg6
          InNJRTRt7al/63FSPEgSCqOX6asDVDNZ83db0dOcoeaPEiDz3liE3+tYHtKXj5/qwTtYd
          aqBZxdJfuCKZveEFe1DO3/ayDvIvG9Eme+rEjntErF+Cw9a8ukesvDuT49cRE9oTs3O7f
          6LUbhCv5zJN+dTFr75NSdWdp4yvn3nK3i2udeMnTWK0U
        </ds:X509Certificate></ds:X509Data>
      </ds:KeyInfo>
    </ds:Signature>
    <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
    <saml:Conditions NotBefore="2021-12-15T10:39:31Z" NotOnOrAfter="2021-12-15T11:09:31Z"><saml:OneTimeUse/></saml:Conditions>
  </samlp:AuthnRequest>

You can process this message and access its properties with the following code:

  Samlreader reader = new Samlreader();

  reader.ValidateSignatures = true;
  reader.Open(req);

  Log("SAML document loaded. The message is of the " + reader.InputTypeString + " type, and was issued by " + reader.Issuer + " at " + reader.IssueInstant + ".");

  if (reader.InputType == SamlreaderInputTypes.cstyAuthnRequest)
  {
      Log("AuthnRequest.ConsumerServiceURL: " + reader.AuthnRequest.AssertionConsumerServiceURL);
      Log("AuthnRequest.ProtocolBinding: " + reader.AuthnRequest.ProtocolBinding);
      Log("AuthnRequest.Conditions.NotBefore: " + reader.AuthnRequest.ConditionsNotBefore);
      Log("AuthnRequest.Conditions.NotAfter: " + reader.AuthnRequest.ConditionsNotOnOrAfter);
  }

  if (reader.Signed) 
  {
      Log("The message was signed by " + reader.SigningCertificate.SubjectRDN);
      Log("Signature validity: " + reader.SignatureValidationResult.ToString());
  }

Property List

The following is the full list of the properties of the class with short descriptions. Click on the links for further details.


artifact_endpoint_index	An accessor to the EndpointIndex entry of the artifact.
artifact_message_handle	An accessor to the MessageHandle property of the artifact.
artifact_remaining_artifact	Returns the contents of the artifact.
artifact_source_id	An accessor to the SourceID property of the artifact.
artifact_type_code	The TypeCode property of the artifact.
artifact_uri	An accessor to the URI property of the artifact.
artifact_resolve_query	Returns the content of the ArtifactResolve query.
assertion_count	Returns the number of assertions in the SAML message.
assertion_id_request_references	Contains the References entry of the SAML assertion ID request.
attr_query_attr_count	The number of records in the AttrQueryAttr arrays.
attr_query_attr_friendly_name	Specifies the friendly name of the attribute Use this property to access or set the friendly name of a SAML attribute (e.
attr_query_attr_name	Specifies the name of the attribute.
attr_query_attr_name_format	Indicates the format used to reference the attribute.
attr_query_attr_statement_index	Contains the index of the statement the attribute corresponds to.
attr_query_attr_values	Contains a list of attribute values.
authn_query_comparison	Specifies the authentication context comparison method.
authn_query_context_class_refs	Specifies the context class reference.
authn_query_ref_type	Specifies the context reference type.
authn_query_session_index	Specifies the index of the session to the authentication entity.
authn_request_assertion_consumer_service_index	Specifies the assertion consumer service index.
authn_request_assertion_consumer_service_url	Specifies the assertion consumer service URL.
authn_request_attribute_consuming_service_index	Specifies the attribute consuming service index.
authn_request_conditions_not_before	Specifies the NotBefore condition of the request.
authn_request_conditions_not_on_or_after	Provides access to the NotOnOrAfter condition of the request.
authn_request_context_class_refs	Provides access to the authentication context class references.
authn_request_context_comparison	Specifies the AuthnContext comparison method.
authn_request_context_ref_type	Specifies the context reference type.
authn_request_force_authn	Corresponds to the ForceAuthn parameter of the request.
authn_request_is_passive	Maps to the IsPassive parameter of the request.
authn_request_name_id_policy_allow_create	Matches the AllowCreate attribute of NameIDPolicy element of the request.
authn_request_name_id_policy_format	Matches to the Format attribute of the NameIDPolicy element of the request.
authn_request_name_id_policy_sp_name_qualifier	Matches to the SP name qualifier attribute of the request.
authn_request_name_id_policy_use_allow_create	Controls inclusion of AllowCreate attribute in the request.
authn_request_protocol_binding	Specifies the protocol binding to be requested in the authentication request.
authn_request_provider_name	Specifies the name of the requestor.
authn_request_scoping_idp_list_get_complete	Matches the GetComplete element of the IDPList entry of the Scoping object.
authn_request_scoping_proxy_count	The maximum number of proxies on the way between the requestor and the provider.
authn_request_scoping_requester_i_ds	A collection of requestor IDs on whose behalf the request is being sent.
authn_request_use_force_authn	Controls inclusion of ForceAuthn attribute in the request.
authn_request_use_is_passive	Controls inclusion of IsPassive attribute in the request.
authn_request_condition_count	The number of records in the AuthnRequestCondition arrays.
authn_request_condition_audience_list	An accessor to the Audience list parameter of an audience restriction condition.
authn_request_condition_condition_type	Specifies a type of the condition object.
authn_request_condition_proxy_restriction_count	An accessor to the proxy restriction count element of the condition.
authn_request_scoping_idp_count	The number of records in the AuthnRequestScopingIDP arrays.
authn_request_scoping_idp_loc	Contains the value of the Loc attribute.
authn_request_scoping_idp_name	Contains the name of the IdP provider.
authn_request_scoping_idp_provider_id	Contains the provider ID.
authz_decision_query_actions	Specifies the list of actions included in the query.
authz_decision_query_resource	Matches the Resource element of the query.
binding	Returns the SAML message binding type.
blocked_cert_count	The number of records in the BlockedCert arrays.
blocked_cert_bytes	Returns raw certificate data in DER format.
blocked_cert_handle	Allows to get or set a 'handle', a unique identifier of the underlying property object.
chain_validation_details	The details of a certificate chain validation outcome.
chain_validation_result	The general outcome of a certificate chain validation routine. Use ChainValidationDetails to get information about the reasons that contributed to the validation result.
consent	Returns the Consent parameter of the SAML message.
decryption_certificate_bytes	Returns raw certificate data in DER format.
decryption_certificate_handle	Allows to get or set a 'handle', a unique identifier of the underlying property object.
destination	Returns the Destination parameter of the SAML message.
id	Returns the ID of the processed message.
ignore_chain_validation_errors	Makes the class tolerant to chain validation errors.
input_type	Returns the type of the processed message.
input_type_string	Returns the type of the processed message, as an original string.
in_response_to	Returns the in-response-to parameter of the message.
issue_instant	Returns the issue time of the message.
issuer	Returns the issuer of the message.
known_cert_count	The number of records in the KnownCert arrays.
known_cert_bytes	Returns raw certificate data in DER format.
known_cert_handle	Allows to get or set a 'handle', a unique identifier of the underlying property object.
known_crl_count	The number of records in the KnownCRL arrays.
known_crl_bytes	Returns raw CRL data in DER format.
known_crl_handle	Allows to get or set a 'handle', a unique identifier of the underlying property object.
known_ocsp_count	The number of records in the KnownOCSP arrays.
known_ocsp_bytes	Buffer containing raw OCSP response data.
known_ocsp_handle	Allows to get or set a 'handle', a unique identifier of the underlying property object.
logout_request_name_id	Contains the value of the NameID parameter.
logout_request_not_on_or_after	Contains the value of the NotOnOrAfter parameter.
logout_request_reason	Contains the value of the Reason parameter.
logout_request_session_indexes	Contains the list of session indices.
manage_name_id_request_name_id	Contains the value of the NameID parameter of the request.
manage_name_id_request_new_encrypted_id	Contains the value of the NewEncryptedID parameter of the request.
manage_name_id_request_new_id	Contains the value of the NewID parameter.
manage_name_id_request_terminate	Contains the value of the Terminate parameter of the request.
name_id_mapping_request_name_id	An accessor to the NameID parameter of the request.
name_id_mapping_request_name_id_policy_allow_create	Contains the value of AllowCreate parameter of the NameIDPolicy object.
name_id_mapping_request_name_id_policy_format	Specifies the format of the NameIDPolicy element.
name_id_mapping_request_name_id_policy_sp_name_qualifier	Contains the SPNameQualifier parameter of the NameIDPolicy element.
name_id_mapping_request_name_id_policy_use_allow_create	Controls inclusion of UseAllow modifier in the NameIDPolicy object.
offline_mode	Switches the class to the offline mode.
pinned_assertion_attr_count	The number of records in the PinnedAssertionAttr arrays.
pinned_assertion_attr_friendly_name	Specifies the friendly name of the attribute Use this property to access or set the friendly name of a SAML attribute (e.
pinned_assertion_attr_name	Specifies the name of the attribute.
pinned_assertion_attr_name_format	Indicates the format used to reference the attribute.
pinned_assertion_attr_statement_index	Contains the index of the statement the attribute corresponds to.
pinned_assertion_attr_values	Contains a list of attribute values.
pinned_assertion_condition_count	The number of records in the PinnedAssertionCondition arrays.
pinned_assertion_condition_audience_list	An accessor to the Audience list parameter of an audience restriction condition.
pinned_assertion_condition_condition_type	Specifies a type of the condition object.
pinned_assertion_condition_proxy_restriction_count	An accessor to the proxy restriction count element of the condition.
pinned_assertion_info_advice_assertion_count	Contains the number of advice assertions.
pinned_assertion_info_assertion_type	Specifies the type of the assertion.
pinned_assertion_info_chain_validation_details	The details of a certificate chain validation outcome.
pinned_assertion_info_chain_validation_result	The outcome of a certificate chain validation routine.
pinned_assertion_info_conditions_not_before	Represents the Conditions.
pinned_assertion_info_conditions_not_on_or_after	Represents the Conditions.
pinned_assertion_info_encrypted_content	Represents the encrypted assertion content.
pinned_assertion_info_id	Represents the ID of the assertion.
pinned_assertion_info_id_ref	Represents an ID reference value.
pinned_assertion_info_issue_instant	Contains the assertion issuance time stamp.
pinned_assertion_info_signature_validation_result	The outcome of the cryptographic signature validation.
pinned_assertion_info_signed	Specifies whether the assertion is signed.
pinned_assertion_info_uri_ref	Represents an URI reference value.
pinned_assertion_info_validation_log	Contains the signing certificate's chain validation log.
pinned_assertion_info_version	Specifies the SAML protocol version used.
pinned_assertion_issuer	Returns the pinned assertion issuer.
pinned_assertion_statement_count	The number of records in the PinnedAssertionStatement arrays.
pinned_assertion_statement_attributes	Contains a list of statement attribute names.
pinned_assertion_statement_authn_context_authenticating_authorities	Contains the list of authenticating authorities.
pinned_assertion_statement_authn_context_choice	Specifies the authentication context choice variant.
pinned_assertion_statement_authn_context_class_ref	Indicates the authentication contexts class reference.
pinned_assertion_statement_authn_context_decl	Specifies the authentication contexts declaration.
pinned_assertion_statement_authn_context_decl_ref	Specifies the authentication contexts declaration reference.
pinned_assertion_statement_authn_instant	Specifies the authentication event timestamp.
pinned_assertion_statement_authn_session_index	Contains the authentication session index.
pinned_assertion_statement_authn_session_not_on_or_after	Maps to the SessionNotOnOrAfter parameter of the authentication statement.
pinned_assertion_statement_authn_subject_locality_address	Specifies the authentication subjects address.
pinned_assertion_statement_authn_subject_locality_dns_name	Maps to the authentication subjects DNS name parameter.
pinned_assertion_statement_authz_actions	Provides access to the list of actions of the authorization statement.
pinned_assertion_statement_authz_decision	Specifies the authorization decision.
pinned_assertion_statement_authz_decision_evidence	Manages the authorization decision statement evidence parameter.
pinned_assertion_statement_authz_decision_resource	Specifies the authorization decision statement resource parameter.
pinned_assertion_statement_statement_type	Specifies the assertion statement type.
pinned_assertion_subject_confirmation_count	The number of records in the PinnedAssertionSubjectConfirmation arrays.
pinned_assertion_subject_confirmation_data_address	Contains the address enabled for presenting assertions.
pinned_assertion_subject_confirmation_data_in_response_to	The ID of the SAML message in response to which the assertion is issued.
pinned_assertion_subject_confirmation_data_not_before	Time moment before which the subject cannot be confirmed.
pinned_assertion_subject_confirmation_data_not_on_or_after	Limits the time until which the subject can be confirmed.
pinned_assertion_subject_confirmation_data_recipient	The URI of the entity or the location of the resource to which the assertion should be presented.
pinned_assertion_subject_confirmation_data_type	The type of data contained in the confirmation.
pinned_assertion_subject_confirmation_id	The identifier of the entity which can satisfy the subject confirmation requirements.
pinned_assertion_subject_confirmation_method	Specifies the mechanism to be used to confirm the subject.
pinned_assertion_subject_id	Returns the pinned assertion subject.
post_binding_body	Contains the form body.
post_binding_form_template	Contains the XHTML form template returned by the service provider.
post_binding_mode	Specifies whether binding is applied on a server, or on a client side.
post_binding_relay_state	Contains the value of the RelayState parameter of POST binding mechanism.
post_binding_url	Contains the URL of POST binding mechanism.
profile	Specifies a pre-defined profile to apply when creating the signature.
proxy_address	The IP address of the proxy server.
proxy_authentication	The authentication type used by the proxy server.
proxy_password	The password to authenticate to the proxy server.
proxy_port	The port on the proxy server to connect to.
proxy_proxy_type	The type of the proxy server.
proxy_request_headers	Contains HTTP request headers for WebTunnel and HTTP proxy.
proxy_response_body	Contains the HTTP or HTTPS (WebTunnel) proxy response body.
proxy_response_headers	Contains response headers received from an HTTP or HTTPS (WebTunnel) proxy server.
proxy_use_i_pv6	Specifies whether IPv6 should be used when connecting through the proxy.
proxy_use_proxy	Enables or disables proxy-driven connection.
proxy_username	Specifies the username credential for proxy authentication.
redirect_binding_encoding	Specifies the message encoding.
redirect_binding_force_sign	Enforces a signature over all outgoing messages.
redirect_binding_relay_state	Contains the RelayState parameter of the binding.
redirect_binding_sign	Specifies whether to sign generated messages.
redirect_binding_signature_algorithm	Contains the signature algorithm.
redirect_binding_url	Contains the URL of the request query.
redirect_binding_verify_signatures	Instructs the class whether to verify incoming signatures.
redirect_binding_cert_bytes	Returns raw certificate data in DER format.
redirect_binding_cert_handle	Allows to get or set a 'handle', a unique identifier of the underlying property object.
response_name_id	Contains the NameID parameter of a NameIDMapping response.
response_optional_element	An optional message element to be returned with the response.
response_response_type	Contains the type of the response.
response_status_code_sub_value	The value of the nested StatusCode.
response_status_code_value	Contains the status code value.
response_status_detail	Contains additional information on the status of the request.
response_status_message	Contains a status message (optional).
signature_validation_result	Contains the signature validation result.
signed	Returns true it the message is signed.
signing_cert_bytes	Returns raw certificate data in DER format.
signing_cert_ca	Indicates whether the certificate has a CA capability (a setting in BasicConstraints extension).
signing_cert_ca_key_id	A unique identifier (fingerprint) of the CA certificate's private key.
signing_cert_crl_distribution_points	Locations of the CRL (Certificate Revocation List) distribution points used to check this certificate's validity.
signing_cert_curve	Specifies the elliptic curve of the EC public key.
signing_cert_fingerprint	Contains the fingerprint (a hash imprint) of this certificate.
signing_cert_friendly_name	Contains an associated alias (friendly name) of the certificate.
signing_cert_handle	Allows to get or set a 'handle', a unique identifier of the underlying property object.
signing_cert_hash_algorithm	Specifies the hash algorithm to be used in the operations on the certificate (such as key signing) SB_HASH_ALGORITHM_SHA1 SHA1 SB_HASH_ALGORITHM_SHA224 SHA224 SB_HASH_ALGORITHM_SHA256 SHA256 SB_HASH_ALGORITHM_SHA384 SHA384 SB_HASH_ALGORITHM_SHA512 SHA512 SB_HASH_ALGORITHM_MD2 MD2 SB_HASH_ALGORITHM_MD4 MD4 SB_HASH_ALGORITHM_MD5 MD5 SB_HASH_ALGORITHM_RIPEMD160 RIPEMD160 SB_HASH_ALGORITHM_CRC32 CRC32 SB_HASH_ALGORITHM_SSL3 SSL3 SB_HASH_ALGORITHM_GOST_R3411_1994 GOST1994 SB_HASH_ALGORITHM_WHIRLPOOL WHIRLPOOL SB_HASH_ALGORITHM_POLY1305 POLY1305 SB_HASH_ALGORITHM_SHA3_224 SHA3_224 SB_HASH_ALGORITHM_SHA3_256 SHA3_256 SB_HASH_ALGORITHM_SHA3_384 SHA3_384 SB_HASH_ALGORITHM_SHA3_512 SHA3_512 SB_HASH_ALGORITHM_BLAKE2S_128 BLAKE2S_128 SB_HASH_ALGORITHM_BLAKE2S_160 BLAKE2S_160 SB_HASH_ALGORITHM_BLAKE2S_224 BLAKE2S_224 SB_HASH_ALGORITHM_BLAKE2S_256 BLAKE2S_256 SB_HASH_ALGORITHM_BLAKE2B_160 BLAKE2B_160 SB_HASH_ALGORITHM_BLAKE2B_256 BLAKE2B_256 SB_HASH_ALGORITHM_BLAKE2B_384 BLAKE2B_384 SB_HASH_ALGORITHM_BLAKE2B_512 BLAKE2B_512 SB_HASH_ALGORITHM_SHAKE_128 SHAKE_128 SB_HASH_ALGORITHM_SHAKE_256 SHAKE_256 SB_HASH_ALGORITHM_SHAKE_128_LEN SHAKE_128_LEN SB_HASH_ALGORITHM_SHAKE_256_LEN SHAKE_256_LEN .
signing_cert_issuer	The common name of the certificate issuer (CA), typically a company name.
signing_cert_issuer_rdn	A collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate issuer.
signing_cert_key_algorithm	Specifies the public key algorithm of this certificate.
signing_cert_key_bits	Returns the length of the public key.
signing_cert_key_fingerprint	Returns a fingerprint of the public key contained in the certificate.
signing_cert_key_usage	Indicates the purposes of the key contained in the certificate, in the form of an OR'ed flag set.
signing_cert_key_valid	Returns True if the certificate's key is cryptographically valid, and False otherwise.
signing_cert_ocsp_locations	Locations of OCSP (Online Certificate Status Protocol) services that can be used to check this certificate's validity, as recorded by the CA.
signing_cert_policy_i_ds	Contains identifiers (OIDs) of the applicable certificate policies.
signing_cert_public_key_bytes	Contains the certificate's public key in DER format.
signing_cert_self_signed	Indicates whether the certificate is self-signed (root) or signed by an external CA.
signing_cert_serial_number	Returns the certificate's serial number.
signing_cert_sig_algorithm	Indicates the algorithm that was used by the CA to sign this certificate.
signing_cert_subject	The common name of the certificate holder, typically an individual's name, a URL, an e-mail address, or a company name.
signing_cert_subject_key_id	Contains a unique identifier (fingerprint) of the certificate's private key.
signing_cert_subject_rdn	A collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate holder (subject).
signing_cert_valid_from	The time point at which the certificate becomes valid, in UTC.
signing_cert_valid_to	The time point at which the certificate expires, in UTC.
socket_dns_mode	Selects the DNS resolver to use: the class's (secure) built-in one, or the one provided by the system.
socket_dns_port	Specifies the port number to be used for sending queries to the DNS server.
socket_dns_query_timeout	The timeout (in milliseconds) for each DNS query.
socket_dns_servers	The addresses of DNS servers to use for address resolution, separated by commas or semicolons.
socket_dns_total_timeout	The timeout (in milliseconds) for the whole resolution process.
socket_incoming_speed_limit	The maximum number of bytes to read from the socket, per second.
socket_local_address	The local network interface to bind the socket to.
socket_local_port	The local port number to bind the socket to.
socket_outgoing_speed_limit	The maximum number of bytes to write to the socket, per second.
socket_timeout	The maximum period of waiting, in milliseconds, after which the socket operation is considered unsuccessful.
socket_use_i_pv6	Enables or disables IP protocol version 6.
subject_confirmation_count	The number of records in the SubjectConfirmation arrays.
subject_confirmation_data_address	Contains the address enabled for presenting assertions.
subject_confirmation_data_in_response_to	The ID of the SAML message in response to which the assertion is issued.
subject_confirmation_data_not_before	Time moment before which the subject cannot be confirmed.
subject_confirmation_data_not_on_or_after	Limits the time until which the subject can be confirmed.
subject_confirmation_data_recipient	The URI of the entity or the location of the resource to which the assertion should be presented.
subject_confirmation_data_type	The type of data contained in the confirmation.
subject_confirmation_id	The identifier of the entity which can satisfy the subject confirmation requirements.
subject_confirmation_method	Specifies the mechanism to be used to confirm the subject.
subject_id	Returns the subject of the message.
tls_auto_validate_certificates	Specifies whether server-side TLS certificates should be validated automatically using internal validation rules.
tls_base_configuration	Selects the base configuration for the TLS settings.
tls_ciphersuites	A list of ciphersuites separated with commas or semicolons.
tlsec_curves	Defines the elliptic curves to enable.
tls_force_resume_if_destination_changes	Whether to force TLS session resumption when the destination address changes.
tls_pre_shared_identity	Defines the identity used when the PSK (Pre-Shared Key) key-exchange mechanism is negotiated.
tls_pre_shared_key	Contains the pre-shared for the PSK (Pre-Shared Key) key-exchange mechanism, encoded with base16.
tls_pre_shared_key_ciphersuite	Defines the ciphersuite used for PSK (Pre-Shared Key) negotiation.
tls_renegotiation_attack_prevention_mode	Selects renegotiation attack prevention mechanism.
tls_revocation_check	Specifies the kind(s) of revocation check to perform.
tlsssl_options	Various SSL (TLS) protocol options, set of cssloExpectShutdownMessage 0x001 Wait for the close-notify message when shutting down the connection cssloOpenSSLDTLSWorkaround 0x002 (DEPRECATED) Use a DTLS version workaround when talking to very old OpenSSL versions cssloDisableKexLengthAlignment 0x004 Do not align the client-side PMS by the RSA modulus size.
tlstls_mode	Specifies the TLS mode to use.
tls_use_extended_master_secret	Enables Extended Master Secret Extension, as defined in RFC 7627.
tls_use_session_resumption	Enables or disables TLS session resumption capability.
tls_versions	Th SSL/TLS versions to enable by default.
trusted_cert_count	The number of records in the TrustedCert arrays.
trusted_cert_bytes	Returns raw certificate data in DER format.
trusted_cert_handle	Allows to get or set a 'handle', a unique identifier of the underlying property object.
use_binding	Enables or disables automated binding processing.
validate_signatures	Enables or disables automated signature validation.
validation_log	Contains the complete log of the certificate validation routine.
validation_moment	The time point at which chain validity is to be established.
version	Returns SAML content version string.

Method List

The following is the full list of the methods of the class with short descriptions. Click on the links for further details.


compare_i_ds	Compares two SAML IDs.
config	Sets or retrieves a configuration setting.
get_id_prop	Extracts a specific property from a SAML ID.
open	Opens a SAML entity.
open_bytes	Opens a SAML entity.
open_file	Opens a SAML entity.
pin_advice_assertion	Pins advice assertion by propagating it in PinnedAssertionXXX properties.
pin_assertion	Pins assertion by propagating it in PinnedAssertionXXX properties.

Event List

The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.


on_error	Fires to report an error condition.
on_notification	This event notifies the application about an underlying control flow event.
on_signature_found	Signifies the start of signature validation.
on_signature_validated	Reports the signature validation result.

Configuration Settings

The following is a list of configuration settings for the class with short descriptions. Click on the links for further details.


IgnoreSystemTrust	Whether trusted Windows Certificate Stores should be treated as trusted.
TolerateMinorChainIssues	Whether to tolerate minor chain issues.
UseMicrosoftCTL	Enables or disables automatic use of Microsoft online certificate trust list.
UseSystemCertificates	Enables or disables the use of the system certificates.
CheckKeyIntegrityBeforeUse	Enables or disable private key integrity check before use.
CookieCaching	Specifies whether a cookie cache should be used for HTTP(S) transports.
Cookies	Gets or sets local cookies for the class (supported for HTTPClient, RESTClient and SOAPClient only).
DefDeriveKeyIterations	Specifies the default key derivation algorithm iteration count.
EnableClientSideSSLFFDHE	Enables or disables finite field DHE key exchange support in TLS clients.
GlobalCookies	Gets or sets global cookies for all the HTTP transports.
HttpUserAgent	Specifies the user agent name to be used by all HTTP clients.
LogDestination	Specifies the debug log destination.
LogDetails	Specifies the debug log details to dump.
LogFile	Specifies the debug log filename.
LogFilters	Specifies the debug log filters.
LogFlushMode	Specifies the log flush mode.
LogLevel	Specifies the debug log level.
LogMaxEventCount	Specifies the maximum number of events to cache before further action is taken.
LogRotationMode	Specifies the log rotation mode.
MaxASN1BufferLength	Specifies the maximal allowed length for ASN.1 primitive tag data.
MaxASN1TreeDepth	Specifies the maximal depth for processed ASN.1 trees.
OCSPHashAlgorithm	Specifies the hash algorithm to be used to identify certificates in OCSP requests.
UseOwnDNSResolver	Specifies whether the client classes should use own DNS resolver.
UseSharedSystemStorages	Specifies whether the validation engine should use a global per-process copy of the system certificate stores.
UseSystemOAEPAndPSS	Enforces or disables the use of system-driven RSA OAEP and PSS computations.
UseSystemRandom	Enables or disables the use of the OS PRNG.