Map SAML claims using ITfoxtec.Identity.Saml2

Question

I'm using the TestWebAppCore project to test SAML integration for an ASP.NET Core web app and i thought i got it working but the claims that are associated with the user session aren't the claims being returned by the IdP in the SAML Response and i'm not sure what extra configuration is required to map the returned claims.

After clicking Login i'm redirected to my IdP, after logging in my IdP responds with the following SAML response (parts removed to keep question short):

...

    edde16f1-9fee-4e44-9c4d-3810a3a6f73a
    
        
    

...

    
        Ben
    
    
        peter.parker@dailybugle.com
    
    
        Peter
    
    
        Parker
    

...

After logging i'm redirected to the homepage and i see "Hi, edde16f1-9fee-4e44-9c4d-3810a3a6f73a" so i click on "SAML Claims" and the page shows:

The users Claims (Iteration on User.Claims)
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
Value: edde16f1-9fee-4e44-9c4d-3810a3a6f73a
http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod
Value: urn:oasis:names:tc:SAML:2.0:ac:classes:Password
http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant
Value: 2020-11-27T13:10:37.504Z
http://schemas.itfoxtec.com/ws/2014/02/identity/claims/saml2nameid
Value: edde16f1-9fee-4e44-9c4d-3810a3a6f73a
http://schemas.itfoxtec.com/ws/2014/02/identity/claims/saml2nameidformat
Value: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

This list doesn't include the claims i want to use from the SAML response that i get from the IdP, so i tried to add the claims in the ClaimsTransform class by modifying the code slightly:

private static ClaimsPrincipal CreateClaimsPrincipal(ClaimsPrincipal incomingPrincipal)
{
    var claims = new List();

    // All claims
    ////claims.AddRange(incomingPrincipal.Claims);

    var givenName = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname";

    claims.Add(new Claim(givenName, GetClaimValue(incomingPrincipal, givenName)));

    // Or custom claims
    //claims.AddRange(GetSaml2LogoutClaims(incomingPrincipal));
    //claims.Add(new Claim(ClaimTypes.NameIdentifier, GetClaimValue(incomingPrincipal, ClaimTypes.NameIdentifier)));

    return new ClaimsPrincipal(new ClaimsIdentity(claims, incomingPrincipal.Identity.AuthenticationType, ClaimTypes.NameIdentifier, ClaimTypes.Role)
    {
        BootstrapContext = ((ClaimsIdentity)incomingPrincipal.Identity).BootstrapContext
    });
}

private static Claim GetClaim(ClaimsPrincipal principal, string claimType)
{
    return ((ClaimsIdentity)principal.Identity).Claims.FirstOrDefault(c => c.Type == claimType);
}

private static string GetClaimValue(ClaimsPrincipal principal, string claimType)
{
    var claim = GetClaim(principal, claimType);
    return claim?.Value;
}

But this change to the code results in an error from the Claim class:

Value cannot be null.

Value seems to be null wether i add the claim with GivenName or the claim address. Is there additional configuration i'm missing that wil allow me to consume the claims in the "AttributeStatement" section?

Update

Further reading of the code confuses me, in the AssertionConsumerService route the test code is creating a brand new SAMLResponse? The new response doesn't contain any of the attributes from the IdP response which would explain why there are no claims.

If this is how the code is supposed to work, is it possible to include the claims from the IdP response in the new response generated by ITfoxtec.identity.saml2?


    https://my.test.provider
    
        
            
            
            
                
                    
                    
                
                
                IRYj+9sUoEsO5rEgEj+laMogGk0=
            
        
        ...removed...
        
            
                ...removed...
            
        
    
    
        
    
    
        https://my.test.provider
        
            
                
                
                
                    
                        
                        
                    
                    
                    FbSefxSL8LDE1pJdhScHaNijdEY=
                
            
            ...removed...
            
                
                    ...removed...
                
            
        
        
            edde16f1-9fee-4e44-9c4d-3810a3a6f73a
            
                
            
        
        
            
                https://my.test.website
            
        
        
            
                urn:oasis:names:tc:SAML:2.0:ac:classes:Password

Code for the AssertionConsumerService:

[Route("AssertionConsumerService")]
public async Task AssertionConsumerService()
{
    var binding = new Saml2PostBinding();
    var saml2AuthnResponse = new Saml2AuthnResponse(config);

    binding.ReadSamlResponse(Request.ToGenericHttpRequest(), saml2AuthnResponse);
    if (saml2AuthnResponse.Status != Saml2StatusCodes.Success)
    {
        throw new AuthenticationException($"SAML Response status: {saml2AuthnResponse.Status}");
    }
    binding.Unbind(Request.ToGenericHttpRequest(), saml2AuthnResponse);
    await saml2AuthnResponse.CreateSession(HttpContext, claimsTransform: (claimsPrincipal) => ClaimsTransform.Transform(claimsPrincipal));

    var relayStateQuery = binding.GetRelayStateQuery();
    var returnUrl = relayStateQuery.ContainsKey(relayStateReturnUrl) ? relayStateQuery[relayStateReturnUrl] : Url.Content("~/");
    return Redirect(returnUrl);
}

Map SAML claims using ITfoxtec.Identity.Saml2

Answers (1)

Related Questions