diff --git a/src/Config.cs b/src/Config.cs index 2ff3b56..25e798f 100644 --- a/src/Config.cs +++ b/src/Config.cs @@ -460,8 +460,11 @@ public class Config { EntityId = "https://saml-sp1.example.com", DisplayName = "Simple SAML SP", - AssertionConsumerServiceUrls = [new Uri("https://saml-sp1.example.com/acs")], - AssertionConsumerServiceBinding = SamlBinding.HttpPost, + AssertionConsumerServiceUrls = new List + { + new IndexedEndpoint { Location = "https://saml-sp1.example.com/acs", Binding = SamlBinding.HttpPost, Index = 0, IsDefault = true } + }, + AllowedScopes = { "openid", "profile" }, }, // SP with Single Logout @@ -469,12 +472,14 @@ public class Config { EntityId = "https://saml-sp2.example.com", DisplayName = "SAML SP with SLO", - AssertionConsumerServiceUrls = [new Uri("https://saml-sp2.example.com/acs")], - AssertionConsumerServiceBinding = SamlBinding.HttpPost, - SingleLogoutServiceUrl = new SamlEndpointType + AssertionConsumerServiceUrls = new List + { + new IndexedEndpoint { Location = "https://saml-sp2.example.com/acs", Binding = SamlBinding.HttpPost, Index = 0, IsDefault = true } + }, + AllowedScopes = { "openid", "profile" }, + SingleLogoutServiceUrls = new List { - Location = new Uri("https://saml-sp2.example.com/saml/slo"), - Binding = SamlBinding.HttpPost, + new SamlEndpointType { Location = "https://saml-sp2.example.com/saml/slo", Binding = SamlBinding.HttpPost } }, }, @@ -483,13 +488,15 @@ public class Config { EntityId = "https://saml-sp3.example.com", DisplayName = "SAML SP (IdP-initiated)", - AssertionConsumerServiceUrls = [new Uri("https://saml-sp3.example.com/acs")], - AssertionConsumerServiceBinding = SamlBinding.HttpPost, + AssertionConsumerServiceUrls = new List + { + new IndexedEndpoint { Location = "https://saml-sp3.example.com/acs", Binding = SamlBinding.HttpPost, Index = 0, IsDefault = true } + }, AllowIdpInitiated = true, - SingleLogoutServiceUrl = new SamlEndpointType + AllowedScopes = { "openid", "profile" }, + SingleLogoutServiceUrls = new List { - Location = new Uri("https://saml-sp3.example.com/saml/slo"), - Binding = SamlBinding.HttpPost, + new SamlEndpointType { Location = "https://saml-sp3.example.com/saml/slo", Binding = SamlBinding.HttpPost } }, }, }; diff --git a/src/Duende.IdentityServer.Demo.csproj b/src/Duende.IdentityServer.Demo.csproj index fca703d..018b9f0 100644 --- a/src/Duende.IdentityServer.Demo.csproj +++ b/src/Duende.IdentityServer.Demo.csproj @@ -8,10 +8,10 @@ - - - - + + + + diff --git a/src/HostingExtensions.cs b/src/HostingExtensions.cs index b6465f7..adaced7 100644 --- a/src/HostingExtensions.cs +++ b/src/HostingExtensions.cs @@ -53,8 +53,6 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde UseX509Certificate = true }); options.KeyManagement.KeyPath = "/tmp/keys"; - - options.Endpoints.EnableSamlIdpInitiatedEndpoint = true; }) .AddInMemoryApiScopes(Config.ApiScopes) .AddInMemoryIdentityResources(Config.IdentityResources) diff --git a/src/Pages/Account/Create/Index.cshtml.cs b/src/Pages/Account/Create/Index.cshtml.cs index f37cd4c..663ee9d 100644 --- a/src/Pages/Account/Create/Index.cshtml.cs +++ b/src/Pages/Account/Create/Index.cshtml.cs @@ -51,7 +51,7 @@ public async Task OnPost() // if the user cancels, send a result back into IdentityServer as if they // denied the consent (even if this client does not require consent). // this will send back an access denied OIDC error response to the client. - await _interaction.DenyAuthorizationAsync(context, AuthorizationError.AccessDenied, HttpContext.RequestAborted); + await _interaction.DenyAuthorizationAsync(context, InteractionError.AccessDenied, HttpContext.RequestAborted); // we can trust model.ReturnUrl since GetAuthorizationContextAsync returned non-null if (context.IsNativeClient()) diff --git a/src/Pages/Account/Login/Index.cshtml.cs b/src/Pages/Account/Login/Index.cshtml.cs index 60c918f..9cd413b 100644 --- a/src/Pages/Account/Login/Index.cshtml.cs +++ b/src/Pages/Account/Login/Index.cshtml.cs @@ -74,7 +74,7 @@ public async Task OnPost() // if the user cancels, send a result back into IdentityServer as if they // denied the consent (even if this client does not require consent). // this will send back an access denied OIDC error response to the client. - await _interaction.DenyAuthorizationAsync(context, AuthorizationError.AccessDenied, HttpContext.RequestAborted); + await _interaction.DenyAuthorizationAsync(context, InteractionError.AccessDenied, HttpContext.RequestAborted); // we can trust model.ReturnUrl since GetAuthorizationContextAsync returned non-null if (context.IsNativeClient()) diff --git a/src/Pages/Consent/Index.cshtml.cs b/src/Pages/Consent/Index.cshtml.cs index 53efebf..6785816 100644 --- a/src/Pages/Consent/Index.cshtml.cs +++ b/src/Pages/Consent/Index.cshtml.cs @@ -62,7 +62,7 @@ public async Task OnPost() // user clicked 'no' - send back the standard 'access_denied' response if (Input.Button == "no") { - grantedConsent = new ConsentResponse { Error = AuthorizationError.AccessDenied }; + grantedConsent = new ConsentResponse { Error = InteractionError.AccessDenied }; // emit event await _events.RaiseAsync(new ConsentDeniedEvent(User.GetSubjectId(), request.Client.ClientId, request.ValidatedResources.RawScopeValues), HttpContext.RequestAborted); diff --git a/src/Pages/Device/Index.cshtml.cs b/src/Pages/Device/Index.cshtml.cs index e869cf1..f5deab2 100644 --- a/src/Pages/Device/Index.cshtml.cs +++ b/src/Pages/Device/Index.cshtml.cs @@ -73,7 +73,7 @@ public async Task OnPost() { grantedConsent = new ConsentResponse { - Error = AuthorizationError.AccessDenied + Error = InteractionError.AccessDenied }; // emit event diff --git a/src/Pages/Index.cshtml b/src/Pages/Index.cshtml index 206474c..23a4af7 100644 --- a/src/Pages/Index.cshtml +++ b/src/Pages/Index.cshtml @@ -15,7 +15,6 @@
- Duende Software Logo

Welcome to Duende IdentityServer

@@ -72,7 +71,7 @@

- + Go @@ -324,7 +323,7 @@

Demo SAML Service Providers (alpha)

This demo server also acts as a SAML 2.0 Identity Provider. The following service providers are configured for testing. - Use the SAML metadata endpoint to retrieve the IdP metadata for configuring your SP. + Use the SAML metadata endpoint to retrieve the IdP metadata for configuring your SP.

@@ -339,14 +338,20 @@
Entity ID: @sp.EntityId
- ACS Binding: @sp.AssertionConsumerServiceBinding
@foreach (var acs in sp.AssertionConsumerServiceUrls) { - ACS URL: @acs
 + ACS URL: @acs.Location (@acs.Binding)
 } - @if (sp.SingleLogoutServiceUrl != null) + @if (sp.SingleLogoutServiceUrls.Any()) { - SLO URL: @sp.SingleLogoutServiceUrl.Location
 + @foreach (var slo in sp.SingleLogoutServiceUrls) + { + SLO URL: @slo.Location
 + } + } + @foreach (var slo in sp.SingleLogoutServiceUrls) + { + SLO URL: @slo.Location
 } @if (sp.AllowIdpInitiated) { diff --git a/src/Pages/Index.cshtml.cs b/src/Pages/Index.cshtml.cs index 4a6fabd..b98083f 100644 --- a/src/Pages/Index.cshtml.cs +++ b/src/Pages/Index.cshtml.cs @@ -1,7 +1,6 @@ // Copyright (c) Duende Software. All rights reserved. // See LICENSE in the project root for license information. -using Duende.IdentityServer; using System.Reflection; using Microsoft.AspNetCore.Authorization; using Microsoft.AspNetCore.Mvc.RazorPages; @@ -11,11 +10,6 @@ namespace IdentityServerHost.Pages.Home; [AllowAnonymous] public class Index : PageModel { - public Index(IdentityServerLicense? license = null) - { - License = license; - } - public string Version { get => typeof(Duende.IdentityServer.Hosting.IdentityServerMiddleware).Assembly @@ -23,5 +17,4 @@ public string Version ?.InformationalVersion.Split('+').First() ?? "unavailable"; } - public IdentityServerLicense? License { get; } } diff --git a/src/Pages/Saml/IdpInitiated.cshtml b/src/Pages/Saml/IdpInitiated.cshtml new file mode 100644 index 0000000..004c4f3 --- /dev/null +++ b/src/Pages/Saml/IdpInitiated.cshtml @@ -0,0 +1,2 @@ +@page "/saml/idp-initiated" +@model Duende.IdentityServer.Demo.Pages.Saml.IdpInitiatedModel diff --git a/src/Pages/Saml/IdpInitiated.cshtml.cs b/src/Pages/Saml/IdpInitiated.cshtml.cs new file mode 100644 index 0000000..4afd6ef --- /dev/null +++ b/src/Pages/Saml/IdpInitiated.cshtml.cs @@ -0,0 +1,56 @@ +using Duende.IdentityServer.Saml; +using Duende.IdentityServer.Stores; +using Microsoft.AspNetCore.Authorization; +using Microsoft.AspNetCore.Mvc; +using Microsoft.AspNetCore.Mvc.RazorPages; + +namespace Duende.IdentityServer.Demo.Pages.Saml; + +[AllowAnonymous] +public class IdpInitiatedModel : PageModel +{ + private readonly IIdpInitiatedSsoService _idpInitiatedSsoService; + private readonly ISamlServiceProviderStore _spStore; + + public IdpInitiatedModel( + IIdpInitiatedSsoService idpInitiatedSsoService, + ISamlServiceProviderStore spStore) + { + _idpInitiatedSsoService = idpInitiatedSsoService; + _spStore = spStore; + } + + public async Task OnGetAsync(CancellationToken cancellationToken) + { + var spEntityId = HttpContext.Request.Query["spEntityId"].ToString(); + if (string.IsNullOrEmpty(spEntityId)) + { + return BadRequest("spEntityId is required"); + } + + // Validate SP exists and allows IdP-initiated before checking auth + var sp = await _spStore.FindByEntityIdAsync(spEntityId, cancellationToken); + if (sp == null) + { + return BadRequest("Unknown service provider"); + } + if (!sp.AllowIdpInitiated) + { + return BadRequest("Service provider does not allow IdP-initiated SSO"); + } + + // If user is not authenticated, redirect to login + if (User.Identity?.IsAuthenticated != true) + { + return Challenge(); + } + + var result = await _idpInitiatedSsoService.CreateResponseAsync(HttpContext, spEntityId, cancellationToken); + if (result.IsError) + { + return BadRequest(result.Error); + } + await result.Response.ExecuteAsync(HttpContext); + return new EmptyResult(); + } +} diff --git a/src/Pages/Shared/_Nav.cshtml b/src/Pages/Shared/_Nav.cshtml index e3b188d..8859caf 100644 --- a/src/Pages/Shared/_Nav.cshtml +++ b/src/Pages/Shared/_Nav.cshtml @@ -27,16 +27,7 @@ References
  • - OAuth/OIDC Clients -
    • -
  • - SAML SPs -
    • -
  • - APIs -
    • -
  • - Keys + Clients/SPs
  • JWT Decoder diff --git a/src/wwwroot/css/site.css b/src/wwwroot/css/site.css index 81560b1..7646d5e 100644 --- a/src/wwwroot/css/site.css +++ b/src/wwwroot/css/site.css @@ -1,9 +1,5 @@ :root { - --font-family-sans-serif: "Roboto", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; -} - -.welcome-page .logo { - width: 64px; + --font-family-sans-serif: "Funnel Sans", "Inter", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; } /* List group */ @@ -74,7 +70,7 @@ a.navbar-brand span { } a.navbar-brand .icon-banner { margin-top: -4px; - height: 2.5rem; + height: 1.5rem; width: auto; max-width: 100%; object-fit: contain; diff --git a/src/wwwroot/css/site.min.css b/src/wwwroot/css/site.min.css index 4d810e1..5a43a50 100644 --- a/src/wwwroot/css/site.min.css +++ b/src/wwwroot/css/site.min.css @@ -1 +1 @@ -:root{--font-family-sans-serif: "Roboto", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"}.welcome-page .logo{width:64px}.list-group-item{color:#444;background-color:#fff}.list-group-item.disabled,.list-group-item:disabled{color:#5c507c;background-color:#fff}.list-group-item.active,.list-group-item:hover,.list-group-item:focus{z-index:2;color:#444;background-color:#eee;border-color:#eee}.list-group-item.active{font-weight:700}.list-group-item.active:hover{background-color:#fff}.list-group-item.disabled:hover{color:#5c507c}.collapsible-link::before{content:"";width:14px;height:2px;background:#333;position:absolute;top:calc(50% - 1px);right:1rem;display:block;transition:all .3s}.collapsible-link::after{content:"";width:2px;height:14px;background:#333;position:absolute;top:calc(50% - 7px);right:calc(1rem + 6px);display:block;transition:all .3s}.collapsible-link[aria-expanded=true]::after{transform:rotate(90deg) translateX(-1px)}.collapsible-link[aria-expanded=true]::before{transform:rotate(180deg)}a.navbar-brand span{margin-left:10px}a.navbar-brand .icon-banner{margin-top:-4px;height:2.5rem;width:auto;max-width:100%;object-fit:contain;object-position:0 50%}.body-container{margin-top:60px;padding-bottom:40px}.logged-out-page iframe{display:none;width:0;height:0}.grants-page .card{margin-top:20px;border-bottom:1px solid #d3d3d3}.grants-page .card .card-title{font-size:120%;font-weight:bold}.grants-page .card .card-title img{width:100px;height:100px}.grants-page .card label{font-weight:bold}.jwt-decoder-container .row{height:40vh}.jwt-decoder-container .jwt-decoded{text-wrap:auto}.jwt-decoder-container .jwt-decoded.jwt-header{border:4px solid #c586c0}.jwt-decoder-container .jwt-decoded.jwt-payload{border:4px solid #d0872f}.jwt-decoder-container .jwt-decoded.jwt-signature{border:4px solid #86c0c5;color:#dcdcaa !important;overflow-wrap:anywhere}.jwt-decoder-container .jwt-input-editable{word-wrap:anywhere;max-width:100vw}.jwt-decoder-container .jwt-input-editable .text-danger{color:#c586c0 !important}.jwt-decoder-container .jwt-input-editable .text-success{color:#d0872f !important}.jwt-decoder-container .jwt-input-editable .text-warning{color:#86c0c5 !important}.jwt-decoder-container .jwt-input-editable .skipped{text-decoration:line-through}.jwt-decoder-container .json-content,.jwt-decoder-container .jwt-input-editable{font-family:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",monospace;font-size:1em}.jwt-decoder-container .json-content{color:#dcdcaa !important}.jwt-decoder-container .json-content .json-key{color:#9cdcfe !important}.jwt-decoder-container .json-content .json-boolean,.jwt-decoder-container .json-content .json-number{color:#b5cea8 !important}.jwt-decoder-container .json-content .json-string{color:#ce9178 !important}.jwt-decoder-container .json-content .json-explanation{color:#6a9955 !important;font-style:italic}.jwt-decoder-container .json-content .json-structure{color:#dcdcaa !important}.jwt-decoder-container .jwt-signature{font-size:1em} +:root{--font-family-sans-serif: "Funnel Sans", "Inter", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"}.list-group-item{color:#444;background-color:#fff}.list-group-item.disabled,.list-group-item:disabled{color:#5c507c;background-color:#fff}.list-group-item.active,.list-group-item:hover,.list-group-item:focus{z-index:2;color:#444;background-color:#eee;border-color:#eee}.list-group-item.active{font-weight:700}.list-group-item.active:hover{background-color:#fff}.list-group-item.disabled:hover{color:#5c507c}.collapsible-link::before{content:"";width:14px;height:2px;background:#333;position:absolute;top:calc(50% - 1px);right:1rem;display:block;transition:all .3s}.collapsible-link::after{content:"";width:2px;height:14px;background:#333;position:absolute;top:calc(50% - 7px);right:calc(1rem + 6px);display:block;transition:all .3s}.collapsible-link[aria-expanded=true]::after{transform:rotate(90deg) translateX(-1px)}.collapsible-link[aria-expanded=true]::before{transform:rotate(180deg)}a.navbar-brand span{margin-left:10px}a.navbar-brand .icon-banner{margin-top:-4px;height:1.5rem;width:auto;max-width:100%;object-fit:contain;object-position:0 50%}.body-container{margin-top:60px;padding-bottom:40px}.logged-out-page iframe{display:none;width:0;height:0}.grants-page .card{margin-top:20px;border-bottom:1px solid #d3d3d3}.grants-page .card .card-title{font-size:120%;font-weight:bold}.grants-page .card .card-title img{width:100px;height:100px}.grants-page .card label{font-weight:bold}.jwt-decoder-container .row{height:40vh}.jwt-decoder-container .jwt-decoded{text-wrap:auto}.jwt-decoder-container .jwt-decoded.jwt-header{border:4px solid #c586c0}.jwt-decoder-container .jwt-decoded.jwt-payload{border:4px solid #d0872f}.jwt-decoder-container .jwt-decoded.jwt-signature{border:4px solid #86c0c5;color:#dcdcaa !important;overflow-wrap:anywhere}.jwt-decoder-container .jwt-input-editable{word-wrap:anywhere;max-width:100vw}.jwt-decoder-container .jwt-input-editable .text-danger{color:#c586c0 !important}.jwt-decoder-container .jwt-input-editable .text-success{color:#d0872f !important}.jwt-decoder-container .jwt-input-editable .text-warning{color:#86c0c5 !important}.jwt-decoder-container .jwt-input-editable .skipped{text-decoration:line-through}.jwt-decoder-container .json-content,.jwt-decoder-container .jwt-input-editable{font-family:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",monospace;font-size:1em}.jwt-decoder-container .json-content{color:#dcdcaa !important}.jwt-decoder-container .json-content .json-key{color:#9cdcfe !important}.jwt-decoder-container .json-content .json-boolean,.jwt-decoder-container .json-content .json-number{color:#b5cea8 !important}.jwt-decoder-container .json-content .json-string{color:#ce9178 !important}.jwt-decoder-container .json-content .json-explanation{color:#6a9955 !important;font-style:italic}.jwt-decoder-container .json-content .json-structure{color:#dcdcaa !important}.jwt-decoder-container .jwt-signature{font-size:1em} diff --git a/src/wwwroot/css/site.scss b/src/wwwroot/css/site.scss index c5784ae..e5860b5 100644 --- a/src/wwwroot/css/site.scss +++ b/src/wwwroot/css/site.scss @@ -1,11 +1,5 @@ :root { - --font-family-sans-serif: "Roboto", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; -} - -.welcome-page { - .logo { - width: 64px; - } + --font-family-sans-serif: "Funnel Sans", "Inter", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; } /* List group */ @@ -78,7 +72,7 @@ a.navbar-brand { .icon-banner { margin-top: -4px; - height:calc(4rem - 2 * .75rem); + height: 1.5rem; width: auto; max-width: 100%; object-fit: contain; diff --git a/src/wwwroot/duende-logo.svg b/src/wwwroot/duende-logo.svg index adc67d2..8a2c8fb 100644 --- a/src/wwwroot/duende-logo.svg +++ b/src/wwwroot/duende-logo.svg @@ -1,19 +1,3 @@ - - - - - - - - - - - - - - - - - - + + diff --git a/src/wwwroot/duende-white.svg b/src/wwwroot/duende-white.svg index e6baf5e..cb56b9e 100644 --- a/src/wwwroot/duende-white.svg +++ b/src/wwwroot/duende-white.svg @@ -1,19 +1,3 @@ - - - - - - - - - - - - - - - - - - + + diff --git a/src/wwwroot/favicon.ico b/src/wwwroot/favicon.ico index f7ecfd9..0dce6cd 100644 Binary files a/src/wwwroot/favicon.ico and b/src/wwwroot/favicon.ico differ diff --git a/test/SmokeTests/DemoWebApplicationFactory.cs b/test/SmokeTests/DemoWebApplicationFactory.cs index b19bf48..3bd57d8 100644 --- a/test/SmokeTests/DemoWebApplicationFactory.cs +++ b/test/SmokeTests/DemoWebApplicationFactory.cs @@ -1,7 +1,6 @@ using Microsoft.AspNetCore.Hosting; using Microsoft.AspNetCore.Mvc.Testing; using Microsoft.Extensions.DependencyInjection; -using Microsoft.Extensions.Logging; using Serilog; namespace SmokeTests; diff --git a/test/SmokeTests/EndpointSmokeTests.cs b/test/SmokeTests/EndpointSmokeTests.cs index a60240e..7f74ec0 100644 --- a/test/SmokeTests/EndpointSmokeTests.cs +++ b/test/SmokeTests/EndpointSmokeTests.cs @@ -32,7 +32,7 @@ public async Task Homepage_Returns_Ok_With_Expected_Content() // Verify discovery and SAML metadata links document.QuerySelector("a[href='/.well-known/openid-configuration']") .ShouldNotBeNull("Discovery document link should exist"); - document.QuerySelector("a[href='/saml/metadata']") + document.QuerySelector("a[href='/Saml2']") .ShouldNotBeNull("SAML metadata link should exist"); } @@ -57,7 +57,7 @@ public async Task OidcDiscovery_Returns_Valid_Json() public async Task SamlMetadata_Returns_Valid_Xml() { // Act - var response = await _client.GetAsync("/saml/metadata"); + var response = await _client.GetAsync("/Saml2"); // Assert response.StatusCode.ShouldBe(HttpStatusCode.OK); diff --git a/test/SmokeTests/SamlSsoTests.cs b/test/SmokeTests/SamlSsoTests.cs index fa53ee1..3333fe4 100644 --- a/test/SmokeTests/SamlSsoTests.cs +++ b/test/SmokeTests/SamlSsoTests.cs @@ -26,30 +26,18 @@ public async Task AuthenticatedIdpInitiatedReturnsSamlResponseWithValidAssertion var client = CreateClient(); var cookies = await LoginAsync(client, "alice", "alice"); - // Act — Step 1: Hit IdP-initiated endpoint + // Act — Hit IdP-initiated endpoint (returns HTML form directly) var idpInitiatedRequest = CreateRequest( HttpMethod.Get, "/saml/idp-initiated?spEntityId=https://saml-sp3.example.com", cookies); var idpInitiatedResponse = await client.SendAsync(idpInitiatedRequest); - // Should redirect to signin_callback - idpInitiatedResponse.StatusCode.ShouldBe(HttpStatusCode.Redirect); - var callbackLocation = idpInitiatedResponse.Headers.Location?.ToString(); - callbackLocation.ShouldNotBeNull(); - callbackLocation.ShouldContain("/saml/signin_callback"); - - // Collect cookies from this response (SAML state cookie) - var allCookies = MergeCookies(cookies, ExtractCookies(idpInitiatedResponse)); - - // Act — Step 2: Follow redirect to signin_callback - var callbackRequest = CreateRequest(HttpMethod.Get, callbackLocation, allCookies); - var callbackResponse = await client.SendAsync(callbackRequest); - - callbackResponse.StatusCode.ShouldBe(HttpStatusCode.OK); + // Should return 200 with HTML form containing SAMLResponse + idpInitiatedResponse.StatusCode.ShouldBe(HttpStatusCode.OK); // Parse the SAML response from the HTML form - var samlXml = await ExtractSamlResponseFromHtmlAsync(callbackResponse); + var samlXml = await ExtractSamlResponseFromHtmlAsync(idpInitiatedResponse); // Assert — SAML Response structure var response = samlXml.Root; @@ -101,15 +89,11 @@ public async Task AuthenticatedIdpInitiatedReturnsSamlResponseWithValidAssertion authnStatement.Attribute("SessionIndex")?.Value.ShouldNotBeNullOrEmpty(); // AttributeStatement — verify alice's name claim. - // Note: the login flow only puts sub + name on the ClaimsPrincipal, - // so only the "name" claim (which is in the default SAML mapping) appears - // in the assertion. Claims like "email" are on the TestUser but not on - // the auth cookie principal, so the profile service never issues them. GetAttributeValue(assertion, "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name") .ShouldBe("Alice Smith"); // Verify the HTML form posts to the correct ACS URL - var document = await callbackResponse.ParseHtmlAsync(); + var document = await idpInitiatedResponse.ParseHtmlAsync(); var form = document.QuerySelector("form[method='post']"); form.ShouldNotBeNull(); form.GetAttribute("action").ShouldBe("https://saml-sp3.example.com/acs"); @@ -253,33 +237,23 @@ private static async Task> LoginAsync(HttpClient clie } /// - /// Executes the full IdP-initiated SSO flow (redirect chain) and returns the parsed SAML response XML. + /// Executes the full IdP-initiated SSO flow and returns the parsed SAML response XML. /// private static async Task ExecuteIdpInitiatedFlowAsync( HttpClient client, Dictionary cookies, string spEntityId) { - // Step 1: IdP-initiated endpoint + // IdP-initiated endpoint returns HTML form directly (no redirect) var idpRequest = CreateRequest( HttpMethod.Get, $"/saml/idp-initiated?spEntityId={Uri.EscapeDataString(spEntityId)}", cookies); var idpResponse = await client.SendAsync(idpRequest); - idpResponse.StatusCode.ShouldBe(HttpStatusCode.Redirect); - var callbackLocation = idpResponse.Headers.Location?.ToString(); - callbackLocation.ShouldNotBeNull(); - - var allCookies = MergeCookies(cookies, ExtractCookies(idpResponse)); - - // Step 2: Follow redirect to signin_callback - var callbackRequest = CreateRequest(HttpMethod.Get, callbackLocation, allCookies); - var callbackResponse = await client.SendAsync(callbackRequest); - - callbackResponse.StatusCode.ShouldBe(HttpStatusCode.OK); + idpResponse.StatusCode.ShouldBe(HttpStatusCode.OK); - return await ExtractSamlResponseFromHtmlAsync(callbackResponse); + return await ExtractSamlResponseFromHtmlAsync(idpResponse); } /// diff --git a/test/SmokeTests/SmokeTests.csproj b/test/SmokeTests/SmokeTests.csproj index fc22463..301fee5 100644 --- a/test/SmokeTests/SmokeTests.csproj +++ b/test/SmokeTests/SmokeTests.csproj @@ -12,10 +12,15 @@ - - - - + + + + all + runtime; build; native; contentfiles; analyzers; buildtransitive + + + +