Skip to main content

SAML 2.0 Assertion explained

Following is the XML piece of SAML 2.0 assertion (non-encrypted).


In saml:Assertion element, the Version="2.0" identifies this is SAML 2.0 assertion. IssueInstant="2013-08-08T21:54:10.208Z" is the UTC time when this assertion is issued.

saml:Issuer specifies who issues the assertion. The consumer of the assertion could validate against the value to make sure the assertion comes from the desired issuer.

The entire Signature block is related to encrypt and signing of the assertion. It is automatic generated by API.

saml:NameID inside saml:Subject is where you put the primary credential information of the user. It should be some information that can uniquely identify the user.


saml:Conditions defines conditions to use the assertion. The most common condition is time range:
NotBefore is the UTC time when this assertion becomes valid. If the consumer receives the assertion before this time, the assertion is deemed invalid.
NotOnOrAfter is the UTC time when this assertion becomes expired. If the consumer receives the assertion after this time, the assertion is deemed expired.

saml:Audience specifies who this assertion targets to. The consumer can check this field to validate if the assertion is targeted to itself.


Comments

Post a Comment

Popular posts from this blog

Entity framework code first error: OriginalValues cannot be used for entities in the Added state

When I was using Entity framework code first, I encountered an error when I tried to create an entity into database. The entity is: [ Table (" EmployeeProfile ")]     public partial class EmployeeProfile     {         [ Key ]         [DatabaseGeneratedAttribute(DatabaseGeneratedOption.Identity)]         public int EmployeeProfileID { get; set; }         [ ForeignKey ("Employee")]         public int EmployeeID { get; set; }         public virtual Employee Employee { get; set; }         [ ForeignKey (" Profile ")]         public int ProfileID { get; set; }         public virtual Profile Profile { get; set; }       ...
Post a Comment
Read more

X509Certificate2: The system cannot find the file specified.

When I use the new X509Certificate2(fileName, password, X509KeyStorageFlags.DefaultKeySet) to create certificate from certificate file containing private key in my web application, I got following error message: System . Security . Cryptography . CryptographicException : The system cannot find the file specified . at System . Security . Cryptography . CryptographicException . ThrowCryptogaphicException ( Int32 hr ) at System . Security . Cryptography . X509Certificates . X509Utils . _LoadCertFromBlob ( Byte [] rawData , IntPtr password , UInt32 dwFlags , Boolean persistKeySet , SafeCertContextHandle & pCertCtx ) at System . Security . Cryptography . X509Certificates . X509Certificate . LoadCertificateFromBlob ( Byte [] rawData , Object password , X509KeyStorageFlags keyStorageFlags ) at System . Security . Cryptography . X509Certificates . X509Certificate2 .. ctor ( Byte [] rawData , String password , X509KeyStorageFlags keyStorageFlags ) In orde...
10 comments
Read more

Manage IIS 7 remotely using PowerShell and AppCmd

We can use  Windows PowerShell remoting features  to manage IIS 7 websites remotely.  Currently, remoting is supported on Windows Vista with Service Pack 1 or later, Windows 7, Windows Server 2008, and Windows Server 2008 Release 2.  Start Windows PowerShell as an administrator by right-clicking the Windows PowerShell shortcut and selecting Run As Administrator .  Enable PowerShell Remoting with Enable-PSRemoting -Force Starting a Remote Session using:  Enter-PSSession -ComputerName <COMPUTER> -Credential <USER> Now the PowerShell connected to the remote server. Any commands issued with work against the remote server. We can use the Appcmd.exe command line tool to manage remote server just as what we do locally. For example, to add an application pool: c:\windows\system32\inetsrv\appcmd add apppool /name:"Contoso" /managedPipelineMode:Integrated /managedRuntimeVersion:"v4.0" /enable32BitAppOnWin64:true To change application p...
Post a Comment
Read more