C# 生成 saml2 响应无法获取标签的响应部分答案

【问题标题】：C# generate saml2 response can't get the response portion of the tagsC# 生成 saml2 响应无法获取标签的响应部分
【发布时间】：2017-06-14 13:03:26
【问题描述】：

所以我正在尝试使用带有 .net 4.5 System.IdentityModel.Tokens.Saml2Assertion 类的 C# 创建一个 saml2 响应。

到目前为止，我已经创建了一个断言 xml，但是我在这里查看的示例 https://www.samltool.com/generic_sso_res.php 在开头有一些响应标签。我的第一个问题是如何将响应部分添加到我的断言中？（我将在下面发布代码）。我的第二个问题是样本有标签

Saml2NameIdentifier 标识符 = new Saml2NameIdentifier("myid.com");

    Saml2Assertion assert = new Saml2Assertion(identifier);
    assert.Subject = new Saml2Subject(identifier);

    string attrNamespace = "http://id.certmetrics.com/";

    Saml2AttributeStatement attrs = new Saml2AttributeStatement();

    DataRow row = qGetCanData.SqlExecDataTable(null, SelectedCandidate.CmcID).Rows[0];

    //we have a list of key value pairs in the json string that give us an attribute name, and a column name. The column
    //name is what value we would get from the data row using the eval string function
    foreach (KeyValuePair<string, string> item in cset.Attributes)
    {
        string val = EvalString(row, item.Value, string.Empty);
        if (!string.IsNullOrEmpty(val))
        {
            Saml2Attribute attr = new Saml2Attribute(item.Key);
            attr.Values.Add(val);
            attrs.Attributes.Add(attr);
        }
    }

    assert.Statements.Add(attrs);

    StringBuilder sb = new StringBuilder();
    XmlWriterSettings settings = new XmlWriterSettings() { OmitXmlDeclaration = true, Encoding = Encoding.UTF8 };

    // Use this line to get a .p12 file into the Hex format. Then copy/paste the Hex into a string to store it in the source code.
    //string sslCertBytesInHex = Utility.BytesToHex(File.ReadAllBytes(Server.MapPath("~/app_data/ssl.p12")));

    string sslCertBytesInHex = "ABigLongHexHere";


    // This will load the cert just fine. By using "MachineKeySet", we avoid the need to use "Load User Profile"=true in the AppPool.
    X509Certificate2 clientCert = new X509Certificate2();
    clientCert.Import(Utility.HexToBytes(sslCertBytesInHex), "1234", X509KeyStorageFlags.MachineKeySet);

    X509SigningCredentials creds = new X509SigningCredentials(clientCert);

    assert.SigningCredentials = creds;

    Saml2SecurityToken token = new Saml2SecurityToken(assert);

    StringWriter sw = new StringWriter();
    Saml2SecurityTokenHandler tokenHandler = new Saml2SecurityTokenHandler();
    tokenHandler.WriteToken(new XmlTextWriter(sw), token);

    //here is where I don't know how to get that "response" tags porition, plus add in the saml: to all the tags

它生成的 XML 如下所示

<Assertion ID="_6d1bd525-b460-42a7-9def-fe28d26f5713" IssueInstant="2017-06-14T12:54:28.141Z" Version="2.0" xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
    <Issuer>myid.com</Issuer>
    <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
        <SignedInfo>
            <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
            <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
            <Reference URI="#_6d1bd525-b460-42a7-9def-fe28d26f5713">
                <Transforms>
                    <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
                    <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                </Transforms>
                <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
                <DigestValue>SomeString</DigestValue>
            </Reference>
        </SignedInfo>
        <SignatureValue>TheSigValue</SignatureValue>
        <KeyInfo>
            <X509Data>
                <X509Certificate>TheCertValue</X509Certificate>
            </X509Data>
        </KeyInfo>
    </Signature>
    <Subject>
        <NameID>myid.com</NameID>
    </Subject>
    <AttributeStatement>
        <Attribute Name="att1">
            <AttributeValue>att1</AttributeValue>
        </Attribute>
    </AttributeStatement>
</Assertion>

【问题讨论】：

标签： c# saml-2.0

【解决方案1】：

.NET Framework 对 SAML2 的支持仅适用于 SAML2 令牌 - 这是 XML 中的 <Assertion>。要生成<Response> XML，您需要支持 SAML2 协议的东西。要么自己构建它，要么使用现有的库。我所做的开源项目是 Kentor.AuthServices，但也有其他选项，开源和商业。

【讨论】：