I'm writing a SAML 2.0 response parser to handle POST authentication in ASP.Net (in C# and MVC, but that's less relevant).
So I have a .p7b
file to validate with and that can be read into a X509Certificate2Collection
and a sample assertion - a base 64 encoded SAML response.
Ideally I want to use the built in WSSecurityTokenSerializer
, but that fails, so I'm looking for a way that works.
I'm reading the XML directly instead:
// get the base 64 encoded SAML
string samlAssertionRaw = GetFromHttpRequest();
// load a new XML document
var assertion = new XmlDocument { PreserveWhitespace = true };
assertion.LoadXml(samlAssertionRaw);
// use a namespace manager to avoid the worst of xpaths
var ns = new XmlNamespaceManager(assertion.NameTable);
ns.AddNamespace("samlp", @"urn:oasis:names:tc:SAML:2.0:protocol");
ns.AddNamespace("saml", @"urn:oasis:names:tc:SAML:2.0:assertion");
ns.AddNamespace("ds", SignedXml.XmlDsigNamespaceUrl);
// get the signature XML node
var signNode = assertion.SelectSingleNode(
"/samlp:Response/saml:Assertion/ds:Signature", ns);
// load the XML signature
var signedXml = new SignedXml(assertion.DocumentElement);
signedXml.LoadXml(signNode as XmlElement);
// get the certificate, basically:
// signedXml.KeyInfo.OfType<KeyInfoX509Data>().First().
// Certificates.OfType<X509Certificate2>().First()
// but with added checks
var certificate = GetFirstX509Certificate(signedXml);
// check the key and signature match
if (!signedXml.CheckSignature(certificate, true))
{
throw new SecurityException("Signature check failed.");
}
// go on and read the SAML attributes from the XML doc
That lot works, but all it's doing is checking that the signature and the X509Certificate2
public key in the SAML response match. It doesn't in any way verify who it's from, and I need to do that before accepting the SAML authentication.
There appear to be two ways to check the certificate found in the SAML response - I can do certificate.Verify()
or I can do the check with the signature signedXml.CheckSignature(certificate, false)
.
However both return false.
I think this is because they're being checked against the machine store or possibly online (I'm not sure how to check). I want to check them against the X509Certificate2Collection
retrieved from the .p7b
file instead - the certificates registered on the machine should be ignored and just the .p7b
certificates checked.
There doesn't appear to be any way to pass the X509Certificate2Collection
to either the Verify
or CheckSignature
methods.
Is this the right check to be doing on the SAML response?
Is there any way to use the .p7b
certificates the way I want to?
Have you tried using a custom X509Chain
configured to search an ExtraStore
of certificates during the validation process. Something like the following:
// Placeholder for the certificate to validate
var targetCertificate = new X509Certificate2();
// Placeholder for the extra collection of certificates to be used
var certificates = new X509Certificate2Collection();
var chain = new X509Chain();
chain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
chain.ChainPolicy.ExtraStore.AddRange(certificates);
bool isValidCertificate = chain.Build(targetCertificate);
In the example the revocation check is also disabled but if you have online or offline access to the CRL you could enable it.
The ExtraStore
should allow to include intermediate certificates that are not in the machine/user store. However, the trusted root certificate may need to be in the machine or user store depending on the one specified in X509Chain
because otherwise you'll get an UntrustedRoot
fail. If not even the root can be available in a machine or user store you could try to walk up the resulting chain and guarantee that the only error you have is due to an untrusted root and at the same time guaranteeing that the chain root is what you would expect based on the X509Certificate2Collection
you have for validation.
Alternatively you could create your own custom X509CertificateValidator
to validate a certificate taking only in consideration a provided X509Certificate2Collection
.