SAML2P Downloads

• SP: Removed default values for `SignedOutCallbackPath` and `ArtifactResolutionService`, which were introduced in Rsk.Saml v5.0.0. These must now be set explicitly
• SP: Added `SkipAuthnContextCheck` option to ignore parsing and validation of `AuthnContext` in SAML response
• SP: Added `ISamlMessageDestinationValidator` extensibility point for validation of the incoming message `destination` attribute
• IdP: Advertized HTTP-POST binding for SingleLogoutService in metadata document

• IdP & SP: Updated metadata document to use absolute XML namespaces
• IdP: Added diagnostic events using the IdentityServer's built-in event types
• SP: Added support for parsing metadata documents with EntitiesDescriptor containing a single EntityDescriptor
• IdP: Added a null check for ServiceProviderIds in SamlInteractionService.GetSamlSignOutFrameUrl

• IdP: Removed duplicate claims from SAML assertions
• IdP: Added null checks for string extension methods

Features

• IdP: Added support for Duende IdentityServer v6
• SP: Added support for .NET 6
• IdP & SP: Added support for HTTP Artifact binding, which uses a direct server-to-server connection to exchange SAML messages. HTTP Artifact binding can now be used to send and receive all SAML message types. You can read more on this feature in our article: Improving SAML SSO Security Using HTTP Artifact Binding
• IdP: Added support for setting NameIdFormat per Service Provider
• IdP: Added support for sending a RelayState with IdP-initiated SSO
• SP: Added support for configuring SigningOptions

Improvements

• IdP & SP: Added ISamlMetadataSerializer extensibility point for metadata serialization
• IdP & SP: Improved logging, primarily for incoming message validation, to offer more diagnostic information
• IdP & SP: Added configuration option LogSamlMessages. When set to true, SAML messages sent and received will be logged as debug messages
• IdP: AuthenticationContext is set based on OIDC 'amr' values, if SAML compatible. The authentication context will be set to Unspecified if the user did not authenticate using any SAML compatible authentication methods
• SP: ISamlDecryptionService is now used to decrypt both EncryptedAssertion and EncryptedId
• SP: Set default value for `SignedOutCallbackPath` to `/saml/slo`

Bug Fixes

• SP: Fixed an issue where user claims from an incoming assertion containing AuthContextDecl were not parsed
• SP: Fixed signature validation failure for encrypted assertions received via HTTP Artifact binding

Breaking Changes

• IdP: Assertion encryption now uses OAEP instead of PKCS1-v1_5 as the default RSA key transport algorithm. To use RSAES-PKCS1-v1_5, set the UseLegacyRsaEncryption to true

• IdP: Removed duplicate claims from SAML assertions
• IdP: Added null checks for string extension methods

• SP: Fixed an issue where user claims from an incoming assertion containing AuthContextDecl were not parsed
• SP: Fixed signature validation failure for encrypted assertions received via HTTP Artifact binding

• SP: Remove request correlation cookie upon logout response failure
• IdP: Use config option UserInteraction.RequestIdParameter when transporting request ID
• IdP: Throw SamlMessageGeneratorException if the requested and default NameId formats are Email; however, the user does not have an email claim. Previously, we returned SubjectId as the NameId, but with an email claim type

• IdP: Handle numerical boolean values for the AllowCreate attribute in an authentication request
• IdP: Handle the scenario where the user is already signed out upon receiving a SAML logout request 

• IdP: Removed duplicate claims from SAML assertions
• IdP: Added null checks for string extension methods

• SP: Fixed an issue where user claims from an incoming assertion containing AuthContextDecl were not parsed
• SP: Fixed signature validation failure for encrypted assertions received via HTTP Artifact binding

• IdP: Use config option UserInteraction.RequestIdParameter when transporting request ID
• SP: Remove request correlation cookie upon logout response failure

• SP: Added support for the Duende IdentityServer's dynamic auth providers feature
• SP: Added support for sending login hints to IdP, using the `Subject` element in Authentication Requests
• SP: Added support for IdP-initiated RelayState. Added `AllowedIdpInitiatedRelayStates` configuration option
• SP: Use ISamlKeyService for retrieving validation keys in metadata generation

• SP: Fixed an issue where user claims from an incoming assertion containing AuthContextDecl were not parsed
• SP: Fixed signature validation failure for encrypted assertions received via HTTP Artifact binding

• IdP: Use config option UserInteraction.RequestIdParameter when transporting request ID
• SP: Remove request correlation cookie upon logout response failure

• Use the original URL paths to generate SAML messages, avoiding formatting around port numbers
• SP: Support decryption of assertions using AES-GCM
• SP: Use the ISamlSigningCertificateStore in metadata generator

• Fixed SLO with POST binding on Linux

• IdP: Included missing user session update when using IdP-Initiated SSO

• SP: added support for AuthContextDecl attribute when validation SAML assertions

• IdP: Use config option UserInteraction.RequestIdParameter when transporting request ID
• SP: Remove request correlation cookie upon logout response failure

• Fixed SLO with POST binding on Linux
• SP: Use the ISamlSigningCertificateStore in metadata generator
• Use the original URL paths to generate SAML messages, avoiding formatting around port numbers

• IdP: Added support for Duende IdentityServer
• SP: Added support for .NET 5.0
• SP: Dropped dependency on IdentityServer
• IdP: Improved dev experience with ISamlInteractionService. You can now pass the full return URL to the GetRequestContext method. This is not a breaking change as the method can handle both the request ID and return URL.
• IdP and SP: Improved logging of received SAML response messages
• IdP and SP: Added ISamlSigningCertificateStore extensibility point for SAML specific signing material
• IdP: Added ISamlClientStore extensibility point for SAML specific client application configuration
• IdP: Added ISamlResourceStore extensibility for SAML specific resource & scope configuration
• Added SAML-specific configuration options for controlling Content Security Policy (CSP) headers when using the HTTP POST binding

• IdP: Use config option UserInteraction.RequestIdParameter when transporting request ID
• SP: Remove request correlation cookie upon logout response failure

• Use the original URL paths to generate SAML messages, avoiding formatting around port numbers

• Fixed SLO with POST binding on Linux

• IdP: Included missing user session update when using IdP-Initiated SSO

• SP: Added missing artifact binding ACS endpoint to metadata
• SP: Added support for AttributeConsumingService

• SP: Fixed NullReferenceException when loading ARS endpoint from IdP metadata

• IdP: Added "UseLegacyRsaEncryption" option to disable the use of RSAES-PKCS1-v1_5. This will be set to false by default in the next major release
• IdP: Interaction generator service is now called after user authentication, allowing for the use of a consent screen or cancel button
• SP: Added support for parsing ArtifactResolutionServices from IdP metadata
• Added support for NameIDPolicy
• Fixed issue with validating signatures containing repeated/duplicate namespaces (3+)
• Updated internal cryptography libraries to use .NET Core implementations

• October security update

• SP: Updated the default correlation cookie store's delete method to use SP cookie options
• SP: Improved handling of missing correlation cookie
• Logging improvements

• IdP: Metadata now includes all IdentityServer validation keys
• SP: The metadata parser now treats SLO endpoints as optional

New SP library: Rsk.Saml. To use IdP functionality, specific to IdentityServer4, please continue to use Rsk.IdentityServer4.Saml.

• IdP: Added support for IdP-Initiated SSO
• SP: Added support for IdP-Initiated SLO
• IdP: ACS endpoint preference is now ordered by index
• SP: Now uses the correlation cookie name configured in the handlers cookie builder
• SP: SamlBindingService extended to include support for building SOAP binding payloads
• All custom component exceptions inherit from SamlException
• SP: Breaking change on ISamlCorrelationStore

• October security update

• SP: Fixed metadata parsing for multiple signing certificates

• Fixed nonce size when using AES-256-GCM

• SP: Added support for Home Realm Discovery (using "IDPList" and "IDPEntry")
• SP: Added "SamlChallengeProperties" allowing a challenge request to override Home Realm Discovery and Force Authentication

• October security update

• SP: Added support for WantAssertionsSigned

• SP: Support for the artifact binding type
• SP: Added ValidationCertificates for request signing key rollover
• SP: Added RequireEncryptedAssertions option to disallow unencrypted assertions
• SP: Enabled organization and contact metadata options
• Bug fix for signature transforms
• SP: Added support for RequestedAuthenticationContext and validation of AuthnContextClassRef
• SP: Set correlation cookie to essential
• SP: Added RequireSignedSingleLogoutResponses option
• SP: Fix for SLO request using POST binding
• IdP: Added missing serialization for AuthnStatement SessionNotOnOrAfter

• October security update

• IdP & SP: Improved metadata signature generation
• SP: Improved metadata signature validation
• IdP: Added ISamlEndpointService extensibility point for choosing which ACS or SLO endpoint to use

• October security update

• SP: Added missing SLO endpoints to metadata
• SP: Added option to disable Destination validation
• Updated form POST HTML

• October security update

• SP: Added missing SLO endpoint to metadata
• Internal build version fix

• Changed minimum version of IdentityServer4 v3 to v3.1.2
• IdP: Added ISamlNameIdService extensibility point for NameID format handling
• SP: Added AuthenticationProperties to failure results

• October security update

• ASP.NET Core 3.0 and 3.1 support
• IdP & SP: Updated metadata document to place signature as the first element
• SP: Added IdP metadata loading
• SP: Added support for multiple IdP signing certificates
• SP: Added support for SLO response parsing

• SP: Added support for decryption of assertions using:
  • AES-192-CBC
  • AES-128-CBC
• SP: Added support for decryption of assertions with an encrypted key linked by reference

• SP: Added property "SkipUnrecognizedRequests". This property prevents errors from being thrown on invalid SAML requests but allows multiple SP's to share a single metadata endpoint and ACS endpoint

• SP: Added support for encrypted assertions with RSA-OAEP encryption keys

• SP: Added handling for off-spec element "AuthnContextDeclRef"

• SP: Fixed issue with empty name claim being generated from SAMLResponse

• IdP: Fixed CSP for logout page when logout response received
• IdP: Added handling for logout responses sent to SLO endpoint

• SP: Added support for HTTP Redirect binding responses
• SP: Added support for IdP-Initiated SSO
• IdP: Added support for full SAML SP-Initiated SLO
• IdP: Added support for SAML IdP-Initiated SLO

Supports IdentityServer v2.2. This version is no longer actively maintained.