Security Assertion Markup Language well known as SAML is an XML standard for exchanging authentication and authorization data between security domains, that is, between an identity provider and a service provider. SAML is a product of the OASIS Security Services Technical Committee.
By implementing of web service security in interoperable application, you will be almost always required to deal with SAML token. Depending on what your are going to do, there are several helpful scenarios. Most important scenarios are:
- Create the new (signed) token
- Obtain the token from STS (Security Token Service) and do verification
- Persist the (unchanged) token (HDD or memory)
Send the (unchanged) token to some provider (i.e.: WCF service)
Following example shows how to create the SAML token by using of WCF.
private static void Main(string[] args)
{
SamlAssertion assertion = createSamlAssertion();
SamlSecurityToken samlToken = new SamlSecurityToken(assertion);
} /// <summary>
/// Creates some Test SAML assertion
/// </summary>
/// <returns></returns>
private static SamlAssertion createSamlAssertion()
{
// Here we create some SAML assertion with ID and Issuer name.
SamlAssertion assertion = new SamlAssertion();
assertion.AssertionId = "DaenetSamlTest";
assertion.Issuer = "damir";
//
// Create some SAML subject.
SamlSubject samlSubject = new SamlSubject();
samlSubject.Name = "My Subject";
//
// Create one SAML attribute with few values.
SamlAttribute attr = new SamlAttribute();
attr.Namespace = http://daenet.eu/saml;
attr.AttributeValues.Add("Some Value 1");
attr.AttributeValues.Add("Some Value 2"); attr.Name = "My ATTR Value"; //
// Now create the SAML statement containing one attribute and one subject.
SamlAttributeStatement samlAttributeStatement = new SamlAttributeStatement();
samlAttributeStatement.Attributes.Add(attr);
samlAttributeStatement.SamlSubject = samlSubject;
// Append the statement to the SAML assertion.
assertion.Statements.Add(samlAttributeStatement);
return assertion;
} |
However, the SAML token makes a sense if it is digitally signed. Following code snippet shows how to sign the SAML token by using of the X509 certificate, which contains the private key:
/// <summary>
/// Creates some signed Test SAML assertion.
/// </summary>
/// <returns></returns>
private static SamlAssertion createSamlAssertion()
{
//
// Create certificate from file. It must contain private key!
X509Certificate2 cert = new X509Certificate2("filename.cert");
// The private key contained in the certificate will be used to sign the
token.
X509AsymmetricSecurityKey signingKey = new X509AsymmetricSecurityKey(cert);
SamlAssertion assertion = createSamlAssertion(); //
// Signing credentials are consisted
// of private key in the certificate (see above),
// the signature algorithm, security algortihm and key identifier.
assertion.SigningCredentials =
new SigningCredentials(signingKey, SecurityAlgorithms.RsaSha1Signature,
SecurityAlgorithms.Sha1Digest,
new SecurityKeyIdentifier(new X509ThumbprintKeyIdentifierClause(cert))); // Finally create the SamlSecurityToken from the assertion
SamlSecurityToken samlToken = new SamlSecurityToken(assertion); // Create a SecurityTokenSerializer that
// will be used to serialize the SamlSecurityToken
WSSecurityTokenSerializer ser = new WSSecurityTokenSerializer();
using (XmlWriter xWriter = XmlWriter.Create("saml.xml"))
{
ser.WriteToken(xWriter, samlToken);
}
} |
In this example WSSecurityTokenSerializer is used to serialize the SAML token with the provided certificate. The token written in the file "saml.xml" by using of the XmlWriter .
Posted
Feb 22 2007, 07:01 PM
by
Damir Dobric