Very simple SAML 2.0 "consumer" implementation in C#.
It's a SAML client library, not a SAML server, allows adding SAML single-sign-on to your ASP.NET app, but not to provide auth services to other apps.
Install-Package AspNetSaml
This is a .NET Standard 2.0 library that works with both ASP.NET Core and the "old" ASP.NET Framework. Older versions were released as a single c-sharp file you could throw into your project, but starting with v2.0 this is a "proper" class library nuget package.
SAML workflow has 2 steps:
- User is redirected to the SAML provider (where he authenticates)
- User is redirected back to your app, where you validate the payload
Here's how you do it (this example is for ASP.NET MVC):
//this example is an ASP.NET MVC action method
public ActionResult Login()
{
//TODO: specify the SAML provider url here, aka "Endpoint"
var samlEndpoint = "https://saml-provider-that-we-use.com/login/";
var request = new AuthRequest(
"https://www.myapp.com", //TODO: put your app's "entity ID" here
"https://www.myapp.com/SamlConsume" //TODO: put Assertion Consumer URL (where the provider should redirect users after authenticating)
);
//redirect the user to the SAML provider
return Redirect(request.GetRedirectUrl(samlEndpoint));
}User is sent back to your app - you need to validate the SAML response ("assertion") that you recieved via POST.
Here's an example of how you do it in ASP.NET MVC
//ASP.NET MVC action method... But you can easily modify the code for Web-forms etc.
public ActionResult SamlConsume()
{
// 1. TODO: specify the certificate that your SAML provider gave you
string samlCertificate = @"-----BEGIN CERTIFICATE-----
BLAHBLAHBLAHBLAHBLAHBLAHBLAHBLAHBLAHBLAHBLAHBLAH123543==
-----END CERTIFICATE-----";
// 2. Let's read the data - SAML providers usually POST it into the "SAMLResponse" var
var samlResponse = new Response(samlCertificate, Request.Form["SAMLResponse"]);
// 3. We're done!
if (samlResponse.IsValid())
{
//WOOHOO!!! user is logged in
username = samlResponse.GetNameID();
}
}SAML providers usually send more data with their response: username, first/last names etc. Here's how to get it:
if (samlResponse.IsValid())
{
//WOOHOO!!! user is logged in
//Some more optional stuff for you
//let's extract username/firstname etc
string username, email, firstname, lastname;
try
{
username = samlResponse.GetNameID();
email = samlResponse.GetEmail();
firstname = samlResponse.GetFirstName();
lastname = samlResponse.GetLastName();
}
catch(Exception ex)
{
//insert error handling code
//no, really, please do
return null;
}
//user has been authenticated, put your code here, like set a cookie or something...
//or call FormsAuthentication.SetAuthCookie()
//or call context.SignInAsync() in ASP.NET Core
//or do something else
}Depending on your .NET version, your Project should reference System.Security
for .NET Framework and System.Security.Cryptography.Xml for .NET Core.
A version of this library has been used for years in production in our helpdesk app.