VottonseVed
New Member
I'm trying to get a basic SSO sort of thing working. Everything works fine until the point where I've received the Identity Providers response and try to verify the signature of the XML payload so that I can parse out the claims provided to me from them.For example, in the page that the IDP is posting back to, I have the following code to verify that they sent something back:\[code\] Response.Write("<span>Raw data received:<span><br/>"); if (Request.RequestType == "POST") { using (StreamReader sr = new StreamReader(Request.InputStream)) { string requestText = sr.ReadToEnd(); if(!string.IsNullOrEmpty(requestText)) Response.Write("<span>" + requestText + "</span><br/>"); } }\[/code\]I am receiving a huge payload back from the Identity Provider, so I'm pretty confident my issue is that I'm doing the signature verification/unencrypting process wrong.I attempt to verify the signature using:\[code\] bool VerifyResponseSignature(XmlElement response){ return SAMLMessageSignature.Verify(response, idpCertificate);}\[/code\]Here, the idpCertificate is a .cer file that I created using the data given to me in a \[code\]FederationMetadata.xml\[/code\] document. I cut/copied the \[code\]<x509Certificate>\[/code\] string and put it manually into my IdPCertificate.cer file. That's what's being used to verify the signature. It's at that point that it breaks. Is there a better way I'm supposed to be taking the data they provide me in the \[code\]FederationMetatdata\[/code\] file to create a proper certificate to use?Any other troubleshooting suggestions?