@AndersAbel
Sure, I can point you in the right direction...
Hi Guys, I used this code as a sample for my project. It works for old IDP and after I add new, it also works. But when I want to delete it we getting Idp as null from the GetProvider method, as result in the method ValidateSignature, we getting a null reference error. Prety same as here Sustainsys/Saml2#1046
Any advice, how to resolve it?
this one codebuilder.AddSaml2( saml2Options => { saml2Options.SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme; saml2Options.SPOptions.EntityId = new EntityId(config.Saml2.ServiceProviderEntityId); saml2Options.SPOptions.ServiceCertificates.Add(certificate); saml2Options.Notifications.SelectIdentityProvider = (id, data) => GetProvider(identityProviderStore, id, data, saml2Options, logger); saml2Options.Notifications.GetIdentityProvider = (id, data, options) => GetProvider(identityProviderStore, id, data, options, logger); saml2Options.Notifications.AcsCommandResultCreated = (commandResult, response) => { if (commandResult.Principal.Identity is ClaimsIdentity identity) identity.AddClaim(new Claim("in_response_to", response.InResponseTo.Value)); }; });
In the docs, it says about service certificates, "Specifies the certificate(s) that the service provider uses for encrypted assertions (and for signed requests, once that feature is added). If neither of those features are used, this element can be omitted."
What does it mean by "once that feature is added"?
Also, does anyone have an example of how to add a certificate in code (not using .config)?
Can I get a brief explanation of how multiple SP or IdP certificates are used once loaded?
Scenario: we want to load up a certificate and at a later date, its successor to make a seamless transation with no downtime or synchronisation with the IdP. I can load these easily into the ServiceCertificateCollection and they are both emitted through the SP metadata fine.
Question: given I have two certificates loaded, when signing the request, which certificate will Sustainsys use?
Likewise, when an ACS is returned from the IdP and we have two certificates of theirs loaded, does the middleware just look a matching cert?
An unhandled exception occurred while processing the request.
UnexpectedInResponseToException: Received message _82c677e7a5d90abca945562c19e4f868bbd8be7999 contains unexpected InResponseTo "id72b826e83a75492f95940df6de82c7b3". No cookie preserving state from the request was found so the message was not expected to have an InResponseTo attribute. This error typically occurs if the cookie set when doing SP-initiated sign on have been lost.
after login click. How can i resolve the problem?
1 reply
2 replies
7 replies
Hi, i'm getting
An unhandled exception occurred while processing the request.
UnexpectedInResponseToException: Received message _82c677e7a5d90abca945562c19e4f868bbd8be7999 contains unexpected InResponseTo "id72b826e83a75492f95940df6de82c7b3". No cookie preserving state from the request was found so the message was not expected to have an InResponseTo attribute. This error typically occurs if the cookie set when doing SP-initiated sign on have been lost.
after login click. How can i resolve the problem?
I'm getting the same issue after the idp change the account creation process, it now allow the user to log in after the account creation process which can take some time. is it possible to increase the expiration time on the cookie?
1 reply
2 replies
Hello. I am a bit confused on the difference between loading metadata via a URL vs a file with regards to certificates on the local file system. If I configure an IDP with a metadata url then it works fine without having to install certificates. If I download the metadata to a file from that same url and instead load using a metadata location to that relative file path then I get "The signature verified correctly with the key contained in the signature, but that key is not trusted." after authenticating and being redirected back.
The metadata is the same, it's just loaded from a file instead of a URL. Why would I have to install the certificate separately for this case?
1 reply
Hello, I try to add multiple Identity Providers. but I receive an error during login. I don't know if I code the right way. Did you succeed to login with 1 saml option and 2 identity providers? I modified SampleIdentityServer4AspNetIdentity sample.
.AddSaml2(options =>
{
options.SPOptions.EntityId = new EntityId("https://localhost:44342/Saml2");
options.IdentityProviders.Add(
new IdentityProvider(
new EntityId("https://sts.windows.net/a4063b47-a5d6-439****4edea677d/"), options.SPOptions)
{
LoadMetadata = true,
MetadataLocation = "https://login.microsoftonline.com/a4063b47-a5d6-4391-9***ea677d/federationmetadata/2007-06/federationmetadata.xml?appid=487fc7e9-22****61bb78e6924d",
AllowUnsolicitedAuthnResponse = true
});
options.IdentityProviders.Add(new IdentityProvider(
new EntityId("https://sts.windows.net/d4017a0a-1b19-4045-****9105deb9/"), options.SPOptions)
{
LoadMetadata = true,
MetadataLocation = "https://login.microsoftonline.com/d4017a0a-1b19-4045-*****5deb9/federationmetadata/2007-06/federationmetadata.xml?appid=12ac1f71-564b-4e5****610328f55",
AllowUnsolicitedAuthnResponse = true
});
options.SPOptions.ServiceCertificates.Add(new X509Certificate2("Sustainsys.Saml2.Tests.pfx"));
//options.SPOptions.ServiceCertificates.Add(new X509Certificate2(
// HostingEnvironment.ContentRootPath + "\\App_Data\\Sustainsys.Saml2.SampleIdentityServer4AspNetIdentity.pfx"));
})I received this error after login in microsoft azure ad :
Microsoft
Pick an account
Selected user account does not exist in tenant 'sss' and cannot access the application 'https://localhost:44342/Saml2' in that tenant. The account needs to be added as an external user in the tenant first. Please use a different account.
I received this error after login on azure ad :
Sign in
Sorry, but we’re having trouble signing you in.AADSTS50020: User account 'bob@*.onmicrosoft.com' from identity provider 'https://sts.windows.net/d4017a0a-1****b309105deb9/' does not exist in tenant 'simetsdev' and cannot access the application 'https://localhost:44342/Saml2'(Ma*) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.
4 replies
does anyone know when this Sustainsys/Saml2#1313 will get merged, its preventing a .net6 upgrade.
Finally found some time to handle this. I'm merging it to develop and v2right now.
@AndersAbel you said you would merge #1255 for .net support as it removes the hack completely. I created #1307 to address a bug with ephemeral keys and incorporated parts of #1255. A v2 branch is also available if interested. We forked the project internally so we aren't waiting for this but others may be. Happy Thanksgiving
You're right - too much to do and to bad memory from my side. I'll look at it again.
v1. Well that is on kind of life-support. I would really prefer to not do anything but security fixes on that.
Hi
Need help in implementing SAML in organisation apps. I am able to use SAML in Individual and separate application having their own separate DNS.
but stuck at the point, where i have to implement SAML in all application hosted under "Default website" of IIS Server, which are getting accessible with one DNS.
Can someone guide me how can I implement SAML in all those applications which is hosted under "default website" of IIS manager and having same URL (e.g. https://xyz.com/app1 , https://xyz.com/app2 and https://xyz.com/app3 and so on.0
develop branch and get long over due architectural work done. For anyone with opinions - now is the right time to come up with them.
develop branch. The multi-targeting (both frameworks and web platforms) costs a lot to maintain. I think that the existing v1 and v2 versions will work for anyone still on those platforms.
Hi everyone,
just wondering if there are anybody ever try to use dynamics 365 channel integration framework (D365 CIF) and do an SSO with the Sustainsys/Saml2?
D365 CIF : https://docs.microsoft.com/en-us/dynamics365/customer-service/channel-integration-framework/authenticate-channel-users
I'm new to SAML workflow and integration so I follow this tutorial for implementin SAML with Azure AD with asp net core 3.1 webapp.
https://matthijs.hoekstraonline.net/2020/04/14/authenticate-an-azure-ad-user-with-saml-for-asp-net-core/
I tested it locally and everything working fine. After that I try deploy it to azure app service and everything still working.
Last I try to add the app to D365 CIF but its not working because there are an infinite loop of authenticating process and keep adding cookie until the header is too long.
As you can see in the screen shot below it will send SAMLRequest (success) then it is redirected to /Saml2/Acs (I guss this is from the sustainsys?) then redirected back to my app homepage but then the SAML request is send again and repeat.
*note
I guess D365 CIF is using an Iframe to displaying the app that implementing SSO.
I've been looking around for 2 days but didn't get any solution.
