ansaurus

Question

Unsigned SAML 2.0 Support for WCF on .Net 4.0

Answer 1

+1 A:

Not natively. The out of the box SAML 1.1 and SAML 2.0 token handlers sign the tokens. To supoort unsigned tokens you need to create your own token handlers that inherit from

Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler
Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityTokenHandler

override the signiture creation/validation methods, there is a bunch of them, and do nothing in your case. The problem is that you need to control the STS services that issue tokens to you as well which might be difficult if they are not under your control.

Cosmin Onea 2010-09-18 07:03:25

Thanks a lot for your reply.

rauts 2010-09-20 10:04:32

Good News is that we will be creating a on premise STS service over which we can full control. So if i understand correctly, I can create SAML 1.1 and 2.0 signed and unsigned Tokens. And if i need to support Unsigned 2.0 tokens, i will have to create my own token handlers as u mentioned. Do you have any sample code for this implementation? Thanks a lot again.

rauts 2010-09-20 10:06:48

Unfortunately I have no sample code for this, but look at the classes themselves and look at the overridable methods to understand where you need to plug in your code. What I would do is override all methods, just call the base impl in overrides, and set breakpoints in them to see what the flow of processing the token is. Hand craft an unsigned token and pass it to your service and see what method breaks and fix it by simply returning. This is in no way a security design advice :). Can I ask why you dont want to sign the tokens?

Cosmin Onea 2010-09-20 12:35:55

There are use cases where I have to support Unsigned SAML tokens as well. the Service request would be signed anyways so signing the SAML token would add an overhead. So we have to support unsigned SAML tokens as well.

rauts 2010-09-21 08:17:55

Allright, I have not done this before myself, but you need to play with the guts of the token handlers.

Cosmin Onea 2010-09-21 08:51:12

Thanks for all the information. I think i will be able to close this with all the pointers u have provided.

rauts 2010-09-21 09:00:23

ansaurus

tags:

views:

answers:

Unsigned SAML 2.0 Support for WCF on .Net 4.0

related questions