Why is this SAML 2.0 AuthnRequest invalid?

Question

I have C# code to produce a SAML 2.0 AuthnRequest:

String requestXML = "<samlp:AuthnRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"https://saml.example.com/login\" Version=\"2.0\" IssueInstant=\"" + DateTime.Now.ToString("yyyy-MM-ddTHH:mm:ss") + "\" AssertionConsumerServiceIndex=\"0\"><saml:Issuer>https://saml.example.com/login</saml:Issuer><samlp:NameIDPolicy AllowCreate=\"true\" Format=\"urn:oasis:names:tc:SAML:2.0:nameid-format:transient\"/></samlp:AuthnRequest>";
String convertedRequestXML = System.Convert.ToBase64String(System.Text.ASCIIEncoding.ASCII.GetBytes(requestXML));
return Redirect("https://idp.ssocircle.com:443/sso/SSORedirect/metaAlias/ssocircle"+ "?SAMLRequest=" + convertedRequestXML + "&RelayState=" + HttpUtility.UrlEncode("/SamlLogin?ReturnUrl=" + returnurl));

With my actual domain name instead of example.com. I set this up on https://ssocircle.com/ with the SP metadata like this

<md:EntityDescriptor
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
entityID="https://saml.example.com/login">
<md:SPSSODescriptor
    protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <md:AssertionConsumerService index="0"
        Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
        Location="https://saml.example.com/login" />
</md:SPSSODescriptor>
<md:Organization>
    <md:OrganizationName xml:lang="en">
        example
    </md:OrganizationName>
    <md:OrganizationDisplayName xml:lang="en">
        example
    </md:OrganizationDisplayName>
    <md:OrganizationURL xml:lang="en">
        http://www.example.com/
    </md:OrganizationURL>
</md:Organization>

However, the page returns with:

Error occurred
Reason: The SAML Request is invalid.

And unhelpfully, no other errors. I have also tried setting this up with https://openidp.feide.no but that only returned a blank page with a 500 server error.

My get string comes out as

https://idp.ssocircle.com/sso/SSORedirect/metaAlias/ssocircle?SAMLRequest=PHNhbWxwOkF1dGhuUmVxdWVzdCB4bWxuczpzYW1scD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiB4bWxuczpzYW1sPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIiBJRD0iaHR0cHM6Ly9zYW1sLmV4YW1wbGUuY29tL2xvZ2luIiBWZXJzaW9uPSIyLjAiIElzc3VlSW5zdGFudD0iMjAxNC0wOS0xMVQwOTozMTo1NyIgQXNzZXJ0aW9uQ29uc3VtZXJTZXJ2aWNlSW5kZXg9IjAiPjxzYW1sOklzc3Vlcj5odHRwczovL3NhbWwuZXhhbXBsZS5jb20vbG9naW48L3NhbWw6SXNzdWVyPjxzYW1scDpOYW1lSURQb2xpY3kgQWxsb3dDcmVhdGU9InRydWUiIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOm5hbWVpZC1mb3JtYXQ6dHJhbnNpZW50Ii8+PC9zYW1scDpBdXRoblJlcXVlc3Q+&RelayState=%2fSamlLogin%3fReturnUrl%3d31lOpEvtWshJNDa314yOgw%3d%3d

Which https://idp.ssocircle.com/sso/toolbox/samlDecode.jsp is 'unable to decode' and https://rnd.feide.no/simplesaml/module.php/saml2debug/debug.php comes out with

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="https://saml.example.com/login" Version="2.0" IssueInstant="2014-09-11T09:31:57" AssertionConsumerServiceIndex="0"><saml:Issuer>https://saml.example.com/login</saml:Issuer><samlp:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/��[[�]]��\]Y\�

I have also tried with similar results

String convertedRequestXML = System.Convert.ToBase64String(System.Text.UTF8Encoding.UTF8.GetBytes(requestXML));

My questions are 1) Is my SAML AuthnRequest actually valid? 2) Is my encoding method correct? 3) Are there any better tools I can use to debug this? These sites do not give out any helpful (or any at all) error messages when something goes wrong

You could try turning on the System.Net tracing. It might show you more information about the outgoing request and its associated response. See [MSDN](http://msdn.microsoft.com/en-us/library/ty48b824(v=vs.110).aspx) for details about how to do this. — Todd Bowles, Sep 10 '14 at 21:50

score 8 · Accepted Answer · edited May 23 '17 at 12:23

8

It's not enough to Base64 encode the request, you also need to do something called deflating. Read the chapter on the HTTP redirect binding.

There is a explanation on how to defalte in C# here

edited May 23 '17 at 12:23

Community

1
1

answered Sep 11 '14 at 14:14

Stefan Rasmusson

5,445
3
21
48

Thanks Stefan, this was the problem. I used code from http://stackoverflow.com/questions/12090403/how-do-i-correctly-prepare-an-http-redirect-binding-saml-request-using-c-sharp – Sean Forman Sep 12 '14 at 01:59

Why is this SAML 2.0 AuthnRequest invalid?

1 Answers1