Validate SAMLRequest signatures from Federator #91

Copilot · 2026-01-29T17:45:40Z

SAMLRequest Signature Validation Implementation - COMPLETE ✅

Summary

All feedback addressed. The implementation now:

Uses dedicated FederatorRequestValidation config section
Supports multiple SAML signature algorithms with readable switch expression
Has constant for cache key
Has configurable cache expiration with 240 min default
Confirmed cross-platform compatible (Windows/Linux)

Original prompt

This section details on the original issue you should resolve

<issue_title>Validate SAMLRequest Signature</issue_title>
<issue_description>We should validate the SAMLRequest signature incoming from the Federator to have an additional layer of security</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes Validate SAMLRequest Signature #1

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Co-authored-by: fume <2969850+fume@users.noreply.github.com>

…umentation, better error handling Co-authored-by: fume <2969850+fume@users.noreply.github.com>

fume · 2026-01-29T18:14:53Z

WebApps/Proxy/Microsoft.SPID.Proxy/Controllers/ProxyController.cs

 			}

+			// Validate SAMLRequest signature from Federator
+			if (!_technicalChecksOptions.SkipSignaturesValidation)


we need a dedicated option to skip the SAMLRequest signature validation. Definetely not on the technical checks options which are dedicated to samlresponse validation.

Created dedicated FederatorRequestValidationOptions with SkipSAMLRequestSignatureValidation setting. The ProxyController now uses this instead of TechnicalChecks options. Configuration is in the new FederatorRequestValidation section in appsettings.json. (commit 0a13bec)

fume · 2026-01-29T18:19:43Z

WebApps/Proxy/Microsoft.SPID.Proxy/Services/Implementations/SAMLService.cs

+            // Decode and validate that SigAlg matches expected algorithm
+            string decodedSigAlg = HttpUtility.UrlDecode(federatorRequest.SigAlg);
+            if (!decodedSigAlg.Equals("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256", StringComparison.OrdinalIgnoreCase))
+            {
+                _logger.LogWarning("SAMLRequest SigAlg '{sigAlg}' is not supported. Expected rsa-sha256", decodedSigAlg);
+                return false;
+            }


can't we support even other signature algorithms? IF not, explain why

Now supports RSA-SHA256, RSA-SHA1, and RSA-SHA512 per SAML specifications. The algorithm is detected from the SigAlg parameter and the corresponding HashAlgorithmName is used for signature verification. These are the standard algorithms supported by SAML HTTP-Redirect binding. (commit 0a13bec)

fume · 2026-01-29T21:43:23Z

WebApps/Proxy/Microsoft.SPID.Proxy/Services/Implementations/SAMLService.cs

+
+            // Try to get metadata from cache first
+            string metadataXml = null;
+            string cacheKey = "FederatorMetadata";


make this a constant

Made the cache key a constant FEDERATOR_METADATA_CACHE_KEY at the class level. (commit 0a13bec)

fume · 2026-01-29T21:44:54Z

WebApps/Proxy/Microsoft.SPID.Proxy/Services/Implementations/SAMLService.cs

+            {
+                var options = new DistributedCacheEntryOptions()
+                {
+                    AbsoluteExpirationRelativeToNow = TimeSpan.FromMinutes(120),


make this configurable, with a default of 240 minutes

Made cache expiration configurable via FederatorRequestValidationOptions.MetadataCacheAbsoluteExpirationInMins with a default of 240 minutes. Can be configured in appsettings.json under FederatorRequestValidation section. (commit 0a13bec)

fume

@copilot

…, support multiple signature algorithms, use constant for cache key Co-authored-by: fume <2969850+fume@users.noreply.github.com>

fume · 2026-01-29T22:02:56Z

WebApps/Proxy/Microsoft.SPID.Proxy/Services/Implementations/SAMLService.cs

+            if (decodedSigAlg.Equals("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256", StringComparison.OrdinalIgnoreCase))
+            {
+                hashAlgorithm = HashAlgorithmName.SHA256;
+            }
+            else if (decodedSigAlg.Equals("http://www.w3.org/2000/09/xmldsig#rsa-sha1", StringComparison.OrdinalIgnoreCase))
+            {
+                hashAlgorithm = HashAlgorithmName.SHA1;
+            }
+            else if (decodedSigAlg.Equals("http://www.w3.org/2001/04/xmldsig-more#rsa-sha512", StringComparison.OrdinalIgnoreCase))
+            {
+                hashAlgorithm = HashAlgorithmName.SHA512;
+            }
+            else


rewrite this block using a more readable switch case. Keep the logging for the unsupported SigAlg.

Refactored to use a switch expression for better readability. The logging for unsupported SigAlg is preserved. (commit c0fe19c)

fume · 2026-01-29T22:04:51Z

WebApps/Proxy/Microsoft.SPID.Proxy/Services/Implementations/SAMLService.cs

            foreach (var cert in certificates)
            {
                using (RSA rsa = cert.GetRSAPublicKey())
                {
-                    if (rsa != null && rsa.VerifyData(bytesToVerify, signatureBytes, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1))
+                    if (rsa != null && rsa.VerifyData(bytesToVerify, signatureBytes, hashAlgorithm, RSASignaturePadding.Pkcs1))
                    {
                        _logger.LogDebug("SAMLRequest signature validated successfully with certificate: {subject}", cert.Subject);
                        return true;
                    }
                }
            }


double check if this code is cross-platform. This solution could run both on windows and linux

Confirmed cross-platform compatible. The GetRSAPublicKey() and VerifyData() methods are part of the standard .NET cryptography library that works on both Windows and Linux. This pattern is already used elsewhere in the codebase (FederatorResponseService, XMLSignatureExtensions). Added a comment to explicitly document cross-platform compatibility. (commit c0fe19c)

fume

@copilot

…tform compatibility comment Co-authored-by: fume <2969850+fume@users.noreply.github.com>

Initial plan

3dbd62d

Copilot AI assigned Copilot and fume Jan 29, 2026

Copilot started work on behalf of fume January 29, 2026 17:46 View session

Copilot AI and others added 2 commits January 29, 2026 17:50

Implement SAMLRequest signature validation from Federator

cf525b1

Co-authored-by: fume <2969850+fume@users.noreply.github.com>

Address code review feedback: add caching, SigAlg validation, XML doc…

e7f86cd

…umentation, better error handling Co-authored-by: fume <2969850+fume@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add validation for SAMLRequest signature~~ Validate SAMLRequest signatures from Federator Jan 29, 2026

Copilot AI requested a review from fume January 29, 2026 17:58

Copilot finished work on behalf of fume January 29, 2026 17:58

fume reviewed Jan 29, 2026

View reviewed changes

fume requested changes Jan 29, 2026

View reviewed changes

Copilot started work on behalf of fume January 29, 2026 21:47 View session

Address PR feedback: Add dedicated FederatorRequestValidation options…

0a13bec

…, support multiple signature algorithms, use constant for cache key Co-authored-by: fume <2969850+fume@users.noreply.github.com>

Copilot AI requested a review from fume January 29, 2026 21:51

Copilot finished work on behalf of fume January 29, 2026 21:51

fume reviewed Jan 29, 2026

View reviewed changes

fume requested changes Jan 29, 2026

View reviewed changes

Copilot started work on behalf of fume January 29, 2026 22:05 View session

Refactor SigAlg validation to use switch expression and add cross-pla…

c0fe19c

…tform compatibility comment Co-authored-by: fume <2969850+fume@users.noreply.github.com>

Copilot AI requested a review from fume January 29, 2026 22:07

Copilot finished work on behalf of fume January 29, 2026 22:07

fume approved these changes Jan 29, 2026

View reviewed changes

Validate SAMLRequest signatures from Federator #91

Are you sure you want to change the base?

Validate SAMLRequest signatures from Federator #91

Uh oh!

Conversation

Copilot AI commented Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

SAMLRequest Signature Validation Implementation - COMPLETE ✅

Summary

Comments on the Issue (you are @copilot in this section)

Uh oh!

fume Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

fume Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

fume Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

fume Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

fume left a comment

Choose a reason for hiding this comment

Uh oh!

fume Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

fume Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

fume left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Jan 29, 2026 •

edited

Loading