@maartenba the SAML 2.0 Concepts page was meant to be a general overview of SAML (with maybe some light linking into our implementation). Not sure if adding code blocks and implementation details is right for that page.

Addressed review feedback in 21c08bf:

• Removed InCommon example from concepts.md
• Trimmed IdentityServer-specific content on the concepts page (kept brief cross-links)
• Removed all "backwards compatibility" language (this is a new package, no prior version)
• Removed "(not an enum)" from SamlEndpointType
• Changed "request ages" → "request lifetimes"
• Fixed ambiguous "it" in endpoints.md SLO note
• Code-blocked AuthnRequest, AuthnContext, and NameID everywhere in extensibility.md prose
• Added mermaid sequence diagrams for SP-initiated SSO flow and Single Logout flow
• Reviewed "What's Included" section — looks comprehensive, no changes needed

Not addressed (not a docs change): __Host- cookie prefix implementation question (item 11)

Addressed bhazen's review feedback in c9d2d9b:

Removed (platform-only / not in v8):

• ISamlServiceProviderAdmin — entire section + all references
• ServiceProviderEntityId value object — replaced with plain string
• SigninStateCookieName — property being removed from code
• Encryption section (not making v1)
• EncryptionCertificates, EncryptAssertions properties
• RequireConsent (consent doesn't exist in SAML)
• ISamlFrontChannelLogout section (going away)
• Obsolete AssertionConsumerServiceBinding

Fixed:

• ISamlSigninInteractionResponseGenerator → ISaml2SsoInteractionResponseGenerator (no consent)
• ISamlInteractionService — added deprecation note, describes GetAuthenticationContextAsync pattern
• ISamlSigninStateStore — default is in-memory (not cookie), EF for production
• ISamlNameIdGenerator — only email + unspecified (no persistent for v1)
• NameID formats — clarified only email/unspecified supported, persistent planned
• Login Page Compatibility — removed IAuthenticationContext, describes returnUrl + GetAuthenticationContextAsync
• Saml2Options.EntityId — most deployments don't need to set it, default is {host}/saml
• AllowedScopes — simplified description per bhazen's note

Added:

• EF Core store documentation (Duende.IdentityServer.EntityFramework.Stores) in service-providers.md and index.md

Additional review findings

Cross-referenced the docs against the current source code. These are issues not already covered by existing review comments.

configuration.md

1. SamlEndpointType.Location is string, not Uri — The IndexedEndpoint code examples use Location = new Uri("https://sp.example.com/acs") but the actual property type is string. Should be Location = "https://sp.example.com/acs". This also affects service-providers.md and index.md (every SP config example).

2. DisplayName shown as "Required" — The property is string? (nullable) and nothing enforces it. Should be listed as optional.

3. IndexedEndpoint.IsDefault shown as bool? — The actual type is bool (non-nullable).

4. AuthnContextMappings type shown as Dictionary<string, string> — The actual type is IDictionary<string, string>.

5. EmailNameIdClaimType "defaults to ClaimTypes.Email" — The actual default is the string "email", which is a different value than ClaimTypes.Email (http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress).

service-providers.md

6. AddSamlConfigurationStore() does not exist — The EF Core store registration section documents a non-existent extension method. The correct method is AddConfigurationStore(...).

7. ClaimMappings = new ReadOnlyDictionary<string, string>(...) — The full config example won't compile. The property type is IDictionary<string, string>, so this should be new Dictionary<string, string>.

8. Location = new Uri(...) in all SP config examples — Same as finding Re-work reference section #1 above.

index.md

9. Location = new Uri(...) in the Quick Setup SP example — Same as finding Re-work reference section #1.

extensibility.md

10. Default ISamlLogoutNotificationService is a no-op — The docs describe the default as sending LogoutRequests to SPs. The actual default registered in DI is NopSamlLogoutNotificationService, which does nothing. The real Saml2LogoutNotificationService is not the default.

11. IIdpInitiatedSsoService example calls result.ToActionResult() — This method doesn't exist on IdpInitiatedSsoResult.

12. StatusCodes.Responder / StatusCodes.UnknownPrincipal in the ISamlNameIdGenerator example — No namespace/using shown. Could easily be confused with Microsoft.AspNetCore.Http.StatusCodes. Worth adding a comment or using the fully qualified name.

13. Interface signatures show CancellationToken ct = default — The actual interfaces use Ct ct (no default). Affects ISaml2SsoInteractionResponseGenerator, ISaml2SsoResponseGenerator, ISaml2SloResponseGenerator, IAuthnRequestValidator, ILogoutRequestValidator, ISaml2FrontChannelLogoutRequestBuilder. Not a compile error for implementers but the shown signatures don't match the source.