Comments (10)
Note, the root cause is that the types registered at the ctor() RSAPKCS1SHA256SignatureDescription()
are using "typeof(...).FullNameand deep in the signature verification on MS's side they do
Type.GetType(string)`. As this stack overflow hints, using the assembly qualified name instead works.
Thus changing the ctor() to:
public RSAPKCS1SHA256SignatureDescription()
{
//https://stackoverflow.com/a/1825156/494125
KeyAlgorithm = typeof(RSACryptoServiceProvider).AssemblyQualifiedName;
DigestAlgorithm = typeof(SHA256Managed).AssemblyQualifiedName; // Note - SHA256CryptoServiceProvider is not registered with CryptoConfig
FormatterAlgorithm = typeof(RSAPKCS1SignatureFormatter).AssemblyQualifiedName;
DeformatterAlgorithm = typeof(RSAPKCS1SignatureDeformatter).AssemblyQualifiedName;
}
from aspnetsaml.
We've actually removed this code altogether, needed for pre-4.5 .NET versions anyway. Currently testing in production, will push updates here next week.
from aspnetsaml.
@alex-jitbit I got it working by removing all references to these:
RSAPKCS1SHA256SignatureDescription.Init()
There are two places in the code where that is called, and I commented them out and it works now.
I suspect that code conflicts with .net core / .net 5.
I hope that helps you and anyone else running into the problem.
from aspnetsaml.
So, signedXml
is null in debug?
PS. The onelogin's samltool.com you mentioned does not verify signatures at all, so checking the response their - does not actually confirm validity
from aspnetsaml.
@alex-jitbit signedXml is not null:
ValidateSignatureReference() returns true and !isExpired == true, so we are good on those.
Noted on samltool.com. I tested it on https://8gwifi.org/samlverifysign.jsp - not sure if that site is better.
When I select these two options: https://s3.amazonaws.com/vo-random/ShareX/2020/11/chrome_RGe1ylqkfL.png - it passes.
from aspnetsaml.
Then probably the certificate is null. I haven't tested this on .NET Core a lot, will look into this
from aspnetsaml.
@alex-jitbit I'm waiting for your update
from aspnetsaml.
@ @admalledd Thank you
from aspnetsaml.
see #64. Looks like the referenced updates are available from source on github, but have not been published to nuget yet. It's fairly simple to swap out the nuget reference for a reference to the source code directly in your project.
from aspnetsaml.
Thank you, that worked
from aspnetsaml.
Related Issues (20)
- Clear cookie authenticate, LOGOUT
- Get the post method payload in asp.net 3.5 webforms HOT 1
- could i add query parameter in the acs url? will it being redirected with query parameters? HOT 1
- SignedXml CheckSignature issue HOT 6
- System.Security.Cryptography.CryptographicException: ASN1 corrupted data HOT 3
- SAML Response validation fails HOT 1
- saml.config required? HOT 1
- Don't install by copying a file into the consuming project HOT 2
- ASP.Net Webforms: SAMLResponse is null HOT 8
- Not an issue, just a thank you
- Why is there no Single Signout? HOT 1
- timezone changing HOT 3
- Not signed assembly HOT 2
- Error in SAML response - SignatureDescription could not be created for the signature algorithm supplied HOT 3
- Help - Response SAML without NameID HOT 1
- Multiple IDP initiated request support? HOT 2
- Logout Request HOT 3
- whole document covering signature in ValidateSignatureReference
- Vulnerability in System.Security.Cryptography.Xml
- How to redirect if user not logged in? HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from aspnetsaml.