Sustainsys: error: "IDX13102: Exception thrown while reading '[PII is hidden]' for Saml2SecurityToken. Inner exception: 'System.ArgumentException'."

Question

Nuget Packages in use:

Microsoft.AspNetCore.App - 2.1.1
Microsoft.NETCore.App - 2.1.0
Sustainsys.Saml2.AspNetCore2 - 2.2.0

Dotnet Core version: 2.1.302

Implementation

Following code is added in the startup.cs file in ConfigureServices(IServiceCollection services) method:

services.AddSaml2("saml2", options =>
{
    options.SPOptions.EntityId = new Sustainsys.Saml2.Metadata.EntityId(this.Configuration.Get().SPEntityId);
    options.SPOptions.MinIncomingSigningAlgorithm = "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
    options.SPOptions.NameIdPolicy = new Sustainsys.Saml2.Saml2P.Saml2NameIdPolicy(true, Sustainsys.Saml2.Saml2P.NameIdFormat.Unspecified);
    options.IdentityProviders.Add(
            new Sustainsys.Saml2.IdentityProvider(
                new Sustainsys.Saml2.Metadata.EntityId(this.Configuration.Get().SPMetadata), options.SPOptions)
                {
                    LoadMetadata = true,
                    Binding = Sustainsys.Saml2.WebSso.Saml2BindingType.HttpPost
                });
})

The authentication is triggered by following controller action:

[HttpGet]
public IActionResult Login(string returnUrl = null)
{
    var redirectUrl = Url.Content("~/Saml/Callback");
    return Challenge(
        new AuthenticationProperties { RedirectUri = redirectUrl }, "saml2");
}

The authentication with the ID server is successfully done and response is received as POST request on https://SP-Server-xxxx/server/Saml2/Acs as per XML at the end of this post. However, then following error is returned with HTTP code 500:

{
    error: "IDX13102: Exception thrown while reading '[PII is hidden]' for Saml2SecurityToken. Inner exception: 'System.ArgumentException'."
}

Please suggest what is wrong with the setup or the implementation.

Response XML:


    https://ID-Server-yyyy/zzzz/saml2/metadata
    
        
    
    
        https://ID-Server-yyyy/zzzz/saml2/metadata
        
            
                
                
                
                    
                        
                        
                    
                    
                    zzzzz
                
            
             'removed the signature value' 
            
                
                     'removed the certificate' 
                
            
        
        
            
                abc@xyz.com
            
            
                
            
        
        
            
                https://SP-Server-xxxx
            
        
        
            
                urn:oasis:names:tc:SAML:2.0:ac:classes:Password
                name/password/uri
            
        
        
            
                Last Name
            
            
                abc@xyz.com
            
            
                Middle Name
            
            
                First Name
            
            
                Id Value

UPDATE: After setting IdentityModelEventSource.ShowPII to true the error response is changed as followed:

{
    error: "IDX13102: Exception thrown while reading 'AuthnContext' for Saml2SecurityToken. Inner exception: 'System.ArgumentException: IDX13300: 'value' must be an absolute Uri, was: 'name/password/uri' at Microsoft.IdentityModel.Tokens.Saml2.Saml2AuthenticationContext.set_DeclarationReference(Uri value) at Microsoft.IdentityModel.Tokens.Saml2.Saml2AuthenticationContext..ctor(Uri classReference, Uri declarationReference) at Microsoft.IdentityModel.Tokens.Saml2.Saml2Serializer.ReadAuthenticationContext(XmlDictionaryReader reader)'."
}

Based on the error message I assume the ID server needs to set the AuthnContext with a valid URI. Please confirm.

Following is the Stack-Trace:

2018-11-29 08:45:10.700 +01:00 [Debug] Signature validation passed for Saml Response Microsoft.IdentityModel.Tokens.Saml2.Saml2Id
2018-11-29 08:45:10.759 +01:00 [Error] Exception is occurred
Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityTokenReadException: IDX13102: Exception thrown while reading 'AuthnContext' for Saml2SecurityToken. Inner exception: 'System.ArgumentException: IDX13300: 'value' must be an absolute Uri, was: 'name/password/uri'
   at Microsoft.IdentityModel.Tokens.Saml2.Saml2AuthenticationContext.set_DeclarationReference(Uri value)
   at Microsoft.IdentityModel.Tokens.Saml2.Saml2AuthenticationContext..ctor(Uri classReference, Uri declarationReference)
   at Microsoft.IdentityModel.Tokens.Saml2.Saml2Serializer.ReadAuthenticationContext(XmlDictionaryReader reader)'. ---> System.ArgumentException: IDX13300: 'value' must be an absolute Uri, was: 'name/password/uri'
   at Microsoft.IdentityModel.Tokens.Saml2.Saml2AuthenticationContext.set_DeclarationReference(Uri value)
   at Microsoft.IdentityModel.Tokens.Saml2.Saml2AuthenticationContext..ctor(Uri classReference, Uri declarationReference)
   at Microsoft.IdentityModel.Tokens.Saml2.Saml2Serializer.ReadAuthenticationContext(XmlDictionaryReader reader)
   --- End of inner exception stack trace ---
   at Microsoft.IdentityModel.Tokens.Saml2.Saml2Serializer.ReadAuthenticationContext(XmlDictionaryReader reader)
   at Microsoft.IdentityModel.Tokens.Saml2.Saml2Serializer.ReadAuthenticationStatement(XmlDictionaryReader reader)
   at Sustainsys.Saml2.Saml2P.Saml2PSerializer.ReadAssertion(XmlReader reader)
   at Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityTokenHandler.ReadSaml2Token(String token)
   at Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken)
   at Sustainsys.Saml2.Saml2P.Saml2Response.CreateClaims(IOptions options, IdentityProvider idp)+MoveNext()
   at System.Collections.Generic.List`1.AddEnumerable(IEnumerable`1 enumerable)
   at System.Linq.Enumerable.ToList[TSource](IEnumerable`1 source)
   at Sustainsys.Saml2.Saml2P.Saml2Response.GetClaims(IOptions options, IDictionary`2 relayData)
   at Sustainsys.Saml2.WebSso.AcsCommand.ProcessResponse(IOptions options, Saml2Response samlResponse, StoredRequestState storedRequestState)
   at Sustainsys.Saml2.WebSso.AcsCommand.Run(HttpRequestData request, IOptions options)
   at Sustainsys.Saml2.AspNetCore2.Saml2Handler.HandleRequestAsync()
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at Service.Provider.Middleware.LanguageHandlingMiddleware.Invoke(HttpContext context) in X:\Projects\Service-Provider\Middleware\LanguageHandlingMiddleware.cs:line 21
   at Service.Provider.Middleware.ErrorHandlingMiddleware.Invoke(HttpContext context, ILogger`1 logger) in X:\Projects\Service-Provider\Middleware\ErrorHandlingMiddleware.cs:line 22

Update 2

Thanks for the response @Anders. As we dont have control over the ipd, I have requested the idp developers to consider above change. But meanwhile we have tried to dig further into the options. I have referred one the documents hosted here: https://media.readthedocs.org/pdf/saml2/latest/saml2.pdf. The section 2.18.1 lists the attributes of Element. It mentions about IgnoreAuthenticationContextInResponse attribute. Based on the description of the attribute, it seems that making this as true will solve the above error. But I cannot find this attribute while configuring the Compatibility element in SPOtions (options.SPOptions.Compatibility.IgnoreAuthenticationContextInResponse ?)

We are using Sustainsys.Saml2.AspNetCore2 package version 2.2.0.

Is it so that the Compatibility.IgnoreAuthenticationContextInResponse attribute is not yet available in version 2.2.0 ?

Sustainsys: error: "IDX13102: Exception thrown while reading '[PII is hidden]' for Saml2SecurityToken. Inner exception: 'System.ArgumentException'."

Nuget Packages in use:

Implementation

Answers (1)

Related Questions

Sustainsys: error: &quot;IDX13102: Exception thrown while reading &#39;[PII is hidden]&#39; for Saml2SecurityToken. Inner exception: &#39;System.ArgumentException&#39;.&quot;

Nuget Packages in use:

Implementation

Answers (1)

Related Questions

Sustainsys: error: "IDX13102: Exception thrown while reading '[PII is hidden]' for Saml2SecurityToken. Inner exception: 'System.ArgumentException'."