From abde9a31d80a14acf0c81625ecbcf1619963854a Mon Sep 17 00:00:00 2001 From: Thomas Nymand Date: Mon, 6 Jul 2026 11:55:16 +0200 Subject: [PATCH 1/4] REF-13 Support CNG signing certificates and renew demo SP certificate Make the signature layer provider-agnostic so signing/decryption works with CNG-stored private keys (RSACng), not just legacy CryptoAPI (RSACryptoServiceProvider). The legacy X509Certificate2.PrivateKey accessor throws "Invalid provider type specified" on a CNG key, which broke the SP when its signing certificate was imported into the CNG "Microsoft Software Key Storage Provider". Framework: - SignatureProvider: sign/verify via the RSA base-class API (SignData/VerifyData with HashAlgorithmName + Pkcs1). ToSha2CapableRsa keeps it provider-agnostic: CNG keys pass through, public keys are re-imported, and legacy PROV_RSA_FULL keys are reopened under PROV_RSA_AES so SHA-2 keeps working. - RsaSha1/256/512SignatureProvider reduced to a HashName property. - Replace X509Certificate2.PrivateKey with GetRSAPrivateKey() in Saml20SignonHandler, Saml20LogoutHandler and Saml20AttributeQuery. - HttpRedirectBindingBuilder.signingKey now accepts any RSA. Demo service provider certificate renewal (previous cert expired 2023-12-01): - certificates/serviceprovider.p12 replaced with the renewed cert (valid to 2029). - WebsiteDemo Web.config/csproj: signing thumbprint updated; SP served on https://localhost; added NemLog-in inttest IdP metadata. Setup scripts (setup_prerequisites.ps1 / functions.ps1): - Import certificates as -Exportable. - Set-CertificatePermission resolves the private key file for both CNG and CSP keys. - Bind a localhost developer certificate to port 20002 (reuse an existing one, or create and trust a self-signed one); remove the serviceprovider SSL pfx + binding. - Remove the unused expired SP signing cert install and the oiosaml-net.dk host entry. - Delete now-unused serviceprovider ssl.pfx and serviceprovider-expired.pfx. Co-Authored-By: Claude Opus 4.8 --- certificates/serviceprovider ssl.pfx | Bin 2627 -> 0 bytes certificates/serviceprovider-expired.pfx | Bin 2643 -> 0 bytes certificates/serviceprovider.p12 | Bin 6723 -> 7570 bytes setup/functions.ps1 | 55 +++-- setup/setup_prerequisites.ps1 | 60 +++--- src/dk.nita.saml20/WebsiteDemo/Web.config | 17 +- .../WebsiteDemo/WebsiteDemo.csproj | 1 + .../oiosaml3-idp-inttest-25-11-28.xml | 199 ++++++++++++++++++ .../Bindings/HttpRedirectBindingBuilder.cs | 5 +- .../RsaSha1SignatureProvider.cs | 11 +- .../RsaSha256SignatureProvider.cs | 11 +- .../RsaSha512SignatureProvider.cs | 11 +- .../SignatureProviders/SignatureProvider.cs | 73 ++++--- .../Protocol/Saml20LogoutHandler.cs | 5 +- .../Protocol/Saml20SignonHandler.cs | 4 +- .../dk.nita.saml20/Saml20AttributeQuery.cs | 3 +- 16 files changed, 345 insertions(+), 110 deletions(-) delete mode 100644 certificates/serviceprovider ssl.pfx delete mode 100644 certificates/serviceprovider-expired.pfx create mode 100644 src/dk.nita.saml20/WebsiteDemo/idp-metadata/oiosaml3-idp-inttest-25-11-28.xml diff --git a/certificates/serviceprovider ssl.pfx b/certificates/serviceprovider ssl.pfx deleted file mode 100644 index 0b0872248a62e08a4fe4c0389730f73b1ae34954..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2627 zcmZWqc{tQv8~)8=?7IVG5zADo8Z0%-&oPz3jXTs&M5XaNnrkE6kV;3N=S|E0mr z`QRLfPxYcw6=TDpQ1%fx4bF<2JV@ziRsnv~G_;_%oSf8Dv00ipif+E;KK92G* z*e}4QY;CQIj|n>diE2Qhz*cq+j6W|d98&e#h3hJCD&g5=(cAX zF!=unfa{f2nBUrpkcV|rN&2bEtFo!Kp&T~ET=Z2shdw{nzL?j%UnqJG?}yVu#!BqX z@-J1iRZ_g9bm}qjO3S0dhP!MV-#P~`F3>6Kd2{M&+Poef&nZxn=INd2CtE&Y1{TKO zja6#0Q?e2QOZ3y8kJs^kl&U#>pT_uI#dG6K)EtG5+`8+nahyCxa;-2|Wb+o^a?p`- zz)rr1o}Mpowv5HcZD{Sd^sjQ8LmhkW+IO{b=iYUDqQ;hP$wcE;F0q=!Pdqb%nN0cK zKG{CL4VkJ%QLEg$^IuKMBp#MucU1a-TXGyKJ)UnW*-y`_G16u9=GHX3V5dl}qUyYd zMt&ri&@iwm_vby52mg|JUujm9I(Ng-Qgtiyc<^JzV0iPybP3fX4?@3y)t*_txs5WC zcv(s}Q>ZmE=pK%y8a7UPILPdSL*OjF*IvwP@gvJIQe>qceQ(>^^%{?f;myLm9J-%&ud7xdctJ&(&nnvPO zFoQUuxEB9abgDtVqve?9dimM}v6KCdme&JoZoM{v+0#<}$gMvkYM#wVDD*!m%NT;k zxm*2ZDZ!lAH5B&gDJc{<`dC$=&1d524(sYPy4ABXOZ{z{&L$>Wb71IU(}iK?f=-L3 z%Z#q|#Hhd%__}pRIT^PJjEc|SyCNChlIRnc;6HIInF4`#mQTeuQ9rx3ERQW8|7&)- zv_)H+cy-Ze?@tm>>cK2uwBli|sygauYASpCK-b9#xj40csh9dra*;eFeih#o*007|J{~<+G?Idl0 zaKI1107L-yE3^T1Kn>6U8BIV7oKJvA15gFE3n0<~kuTu=i&F!UABfe#Q41V@@g9K-wfz}rQxz}Hlbb=77of+~h{ zvI6+NFuLmU>Q3DqIet;pt7#csxyP&06p32*fEdZa&$-raILkkUAXuCOSmAA(?%cKb zLpRG{LnM{>BR4jN7bApI`sC8doeqyNMane?VteCleklcqF4k4Mx5mxiHo!81!NTrg=Dpz^Z77zNrt?G#WEcFvewSck4tWh^M3l&c69d z^6HLOD-#qxs$R%Fy9A}}19JqYYlmkmPADv~-8`nKaSaK>#P7S#56CjCZgqVuVUgT= zJVXkQbj(YT!vggu3l#r#r(MX)@_-o>xdyibs(CmN6GCc<48o#JOGD-M_=-huCX)M%3v zI&j!5+pMtkXXzN1s0XLdQs)x%FHLh4ixE_s%)Tlr)#x{@@R~eHlUH#K`U;0Jzk!)upvTZ!BH_Tjr83+8eKtMkdfY3X?AUUbMTX0(|34g^5O?-t*z*|`fqRfT{O8Ni4C```eG6y zMpz9KrOm7C*laqt;tPaGREE`ScP($V;GLl3cYhQQcB#Hqr0a%W7hNz`9eF8=g0dTt zO5s1gw%I!*5S*Io*+;6!>PzYl+CjnnzmHvRdFWcZ^o|G@ne0`5>s0KR UCQ{jttBMm@$Tv05`+0Hy4MKl~eE;8vT7i+~g0|{uYCOtM zN82s`haJUhHX(8nA4axOCi^Sr#_U!~4wEXC<$&;4v!S2Y7NRE*V!8>u8daHWBlWWGr0m)Ey{3n00DNhp>d(={H(Jz@U_9qNSYaVO1kw?GS z-6l4bs^oPYSk!jNDJ4j2%IxS=>Pn!ceS2MlD0A-T>l-39xjBi1@|=&XZJQa2ZL8tS z?z9WDtWCF#U3SS&YE+hdSJ%O-I*yf~pOZNdJ(fM<)X@9w+ht!@+D{)NY)S_h#nZHA zS_7JK!Ut}2{&;04N#-hV59JMRU5cyf*^5D41?jRF1PO8Fb#s&48FIzeWRr}dkM=5M zjgV24p&9-Dg7H)HdEt4hGZ}C=#;}lW_{4^E6-R;{qZC>*ijd{SP66tv+UfmITpI4H zRP+TIje`c9BYV|-KQ7IVolis=a3?8q)m(5PzqGA;K5w&CTh>9SmprK-+3)Xs(>Rwu zc`&r@TxT3Gyi}l_vySPhnu}Z<(BWhjBlH|bJ-lxdejP8BP^&){%KIJrrR=Wh)Nxf< zl#CK-aUZ8WEN_dq+R3}K`QUnFN;>wWDG)v8GDaF8Z0Uibehh$pKZHH*ER<;*oi{!( zr?}wt8*D}31Vf_QJgvQAIor&Qh>iYqvNa`A9@#JtsJ zY}a~bf#Wsz*(n1hRj2ouZsw!Cgd?Z*BST2NcydgGf$)hIBB9r+*?h1v{Q8!EoUS?x zarQG=`pqnwrt%vT5ugelZ=6{$Tnq&H*6yGF$VeXCpfSb{rlSt3Ex5{+J&l0X5yU~%JVm{T8=uce@GP-Euif_T)Q#kOb(78nChavqUI6e(Y zLzCXzO;YCAD3EEu$gsvF58^*}-Xdi;^xo5IkJ?z5Z+{ddA#uT%)pM$04K_^0iQa#I zDy!fqr<(vZq5(f9nQHhsl_O_Pqq`-=KYRQNDud-8^pJfvp-!G}_%?kH_v)o_fEI({ z5Or&P=1!(1viL9poA?prMWWP^Fa(UIE69Nbz@vZvo+uG45`lmL006rGLkeSwGPXb% zKmjxWAE@a7m!P-^^>~QELA@5B4Iwl z*L!K@aNxj}H4^ht_DyWv+IhiBp%}ep75j88VTX!zPc8(HJ0cd_b_08MsEM1`e1;vB zI-|}e>Cb6j8$@soF@v7@{}g&Mc7|jA6H+7bN*aZg zX|zK;Si@3+=WCdq^~mz2j_U;U7jNCCz=WPBOOdS@#~g~4>eCwgFUrbxY1I?V4ESK;KjeY*iK$S-gvCWS`@Lb68sRz?TWevYY3(>HtDl6Xw z(q9-x#f!)H7)1MHz3odGOt0zsdFxU-+A~3)Pu|<3uZ*Sg`}lDjI_q&1VX$%WoN0IN z%XioK&Rmld4_j37dy+*SazIeF7mtpzMMB!ZsKS~Pelqtu20k3E22kod?XceM;4S@p z|N0t|)zeB7qNRBFLdjba-^6TN@$_(tz& zmWI>i0oSHy7b!JvDI#;>efG-HO`S`l*@+T}ms6rM@9~S4GkHet z_PG#+<$7{gop|xx#1Z#HBc_RH&kO1m5(zW_WkF8l5p_N|ha^JST%6~%;_kQ68%xPo mz0j`XrxceTAcPlvCQ@76zhB>x<>Rtxzo7j7vJ3Oihx`Y%ri=mr diff --git a/certificates/serviceprovider.p12 b/certificates/serviceprovider.p12 index 785b1a6677574c5662d09421c4e2dec42707ff2d..38e512ef1472bf533a509403ca3d7b30426fe4ad 100644 GIT binary patch literal 7570 zcmai(RZtwj)~#U}+%>od86*S2CAb6vLm;^8;BJGvySpSnV1fj92oT&If)m``<>tTl z);W*=Ls#$ht*+Yrw!2n?gQ(&Fh)CcdDrppSP?&t!EjA)5VnGlUFEEIT>mTL-2N8q* zYoQbb5mWp_Zvco0|2Dk;I*4Gy{|IDkuqv4AzY+_~2*j(IW>mV8Q6=D<)nzDn?Ue=q z&=9~_C}{t$D*zoC0ZfI0ZWJbuXpRI#1Of3%H%*p=k)q}hq-(-|kdqGw1Q8WXI*MUw zbyNS5CeXPvKMtgWn!0oX=RIytR&M^w(lgo3>MVPslhY8A07L};lo&srsF=R`3ezohoJ)AxjnBilczDAgu zT4A85G*p(>pWU&2u^@IqilN|8PRVb?^k}ZCawDTZ&!7E33(y3cnt; z#I4Z!bnMKws0+9X?W(%p@5et(t2T?bbc-XWNKBFzr3$|x6GrGiOw&AJK=oht$!&@E zTn6Y=vH6fPDq+k^U*E)rTPn_0l# zmA)Q;WU4aw{H64V&UMdC-xr!;RgeCz*H;z1MdgfonIF=H$z0L0?<#ihLX#ZV{l;!b$`HCA! zE5vG^-OP@!tgO*1?TGdU@ls?y6a!x!HQ|<`e)&XbJlpoK2MoURAdRWFW5$lH=I^Sx zer4}@c>$%{S3cnt@FAuvxtGBqw^VANQn1Xxad}4r2}Xn;RqkHLxIv~{%9IqJ-e|1j zy46o$n&w?Vz4gnZIt+c#r0RQ?EG)CPwxc0F`qqG@-i@UfCXo%zGS7Vo_E=TYTizrr zQQUrR)nbqOQ_=7K=W9YHeewApw8A`u|s@i%esrand;_{fg$b}K1= zespLXT*OV)XSq;3)NhoL6+y+5n>dcDMovQ=J%oKNDSpeLtXX))9$oYG>id{Ph{qE{ z*z{#rYGILe+vo4X3=OXv4b%+VdL$M>UJ|_flYUrq)`geg^mlE=GLa6!FTt?{TlXyp z>Z*9+U0=SN@)6adU|X)f)e1qr>*1UlMbWS@SOt-%TQdEe`(tYUp0ZIeq3(3EF0dfk z=!vS*TA$d;2LpP^WxyyH>B|N(DB-XhkGUbKu_a68eP`$GHG9k_^CpT2UvwfV>nYZP zk^)(RBkh((;JMM0g0^?tg=#z*(XX&ADlXFOE3n1lMJD@%r%jxfFvT38$LDmBkL&PV(qT^hoFYxN^;SUWl8D~BWFDRs;*J}2k3pRZWR_Jc^uA_SgD4~mppYMF5fkrrk%h$5J^Cf%g}GKq3@b8ln@XY2 z!(YZGIb{(*v0Cv`~ zfIO`qU#r}V^-k%sW$CiA@W$@!`qIpEF^=~H)o43Bg08)bn7n7FoN_lW?ww24*5Ha* z`-da6)%=VEJEPn}jtt}8N9t06%5Nim?|}KAsn+ljn24+!?(@g65)UhcTP@S`@y#KN zUO_^s(yrf@5=`qE!(JHHz|K!te06!ghqi%R4havek+2a=S~s`~wS=c8bE>qU`{oN;^r!dLZvxN?i)@8@{zUCSoc57R0#2F^yd6~fB|C#FHr zTeC-FE2EYo6yQX|T{3o54;BCGr+f-X!8N&15Dg-SVLIOoqT4QSMGD$haOqIFSZmGF zFUy~y2agtUp}vk51q9)ozv|$jJ?#4tvCC^x-}}!zeiXs5S755@6-rs{Z_jsT6zUC_ zm!d1+9`A(Q=zCriV${jpTI#}#e?oZ|;_u0wUyF9BTBzV0A`M?4nX05Z>rNlI!+{&x zXRnKYeV!Ip{><1ukgb=hNtF^kWJ$2*zp8w@#8Ts~O$p38Y{={1fEmgJc?^f2%W~qx? z7wYT;OsI~5t96RQbf2O@SYH;IJW_?zLn5K4Cr29*c7)?T?pbBC!r#XH$dNa6JH2Jl zbnX~zoSNf#7sD_iO0CSFmY;RI_AD-{0-Df+>5&#Y4=(5kX5^OWc*nhS5xJ0?m|J-0 zNLHPI-kg%!Xjei$5fw{R@ zhG8^%_6xa5Lp`E^vYeNj;nTERkp{!`#nzVj`$6`2RQDOggBF!sy^iidWWoM)UB~t! z69qC66(AN%k?i*sN*n|PKpk3ipQZ=uQXj(VcsQ^8B4vUlB1xfBWH>BV%l3GY3 zIf-(csMv_^ChN{#I56iD>C*q}olc{!h2&-R8-Qt=mJnMPV>4LP`|of}giXjv3C)i1 zR}Ep~uoyJ;DtIP^dRvj5_7A)Hy=AFrg5hhUb+Un>66($$60#K^QAUZzGQnczB;6HK zj@Y@(z`uzr4#B7+AO9$r{F>^NO7@M046|`&a=dE={Zq~ zWnLj1F?(Rz4gOMjO7AX$f=C@lwlj7nF4h*pV-8q4GgNyNDHvAX@@oi_P@0Iiv}lho z-%QEZU$3s~wnXB%zQ>}KtC91}qwk1)_R=Nyh4l)YcfQw&k(+hwAmzWu&`uyoP zVO(f}F$w;F6nRW2INjSav&hKuY}N4?wu;rt~v1^#WVs0BFPYZ4`0^ zd7A*u^rblR5%t+9haTYUo599ZBfBGV74ZHJ;o~*dZsxr6R#}ok4qPa{Z)rP~90>}6 zlj%|Z_~YU30j~PeGeDh1fw@n96`d2k?!xxkL>W>Nj0BR zpvzk*(j{+tKF7-m3pS}ooHOqsDla}$@FY}(6V5|QYWn=RWffh+nnjZ~McpZoDsv)?qLNo3;nEclZ znvP+L1K{n1ItXKfEt`?&ScyUl-qj#Q*<0dv?v356CP!FF_yMYf2Jw63EGM(Pj90l!}( zCP7cGv1|7w-B{(tdFreSsH?#GC0NvH6y_^PU&K>#M*m(~K?SNPEL_fHM8g{B6YSIk ziT`3p$k%N~DpAVON4f&$YZkX5BoaDZ8Har&;t>A?aFe_hbp=3vfd^4R7sgpx%+mNB z#g6OUG@o`t;+z-+Vj?WHfiZlI zrjo*aPF3C0&s(Q*k5Z7GFDjtyOdi?qnf?psf#%c2G7nsKV%xOD+_}mGnbj;A@l7Y{ zOo1l+tHysMF}vV*Mk-9R{ZU%)NiDbrOQ+%THWV=}h*Wh~rffo8y$u1rrO#Q4DD}C& zXe%qdT3Cu19g#}|u1zE-9N>zqwB^On(alG_7?+aGnB`q4U7;cn7C$A_!6jssk{4U# zt0~{y*`2_QmDv=Pl0m{8ZbILfqavU-ksB_Pp%GF*`u@oq4#oF{I2x~cB-~UMB2op$ zR>v{ghT2a#Uc67gt57!iuz`1}mFG8N3>NCgsa9n*f#_RwHSFe;L`FU`(XJ+2DJi|| z>!C}nr08=X*HPnZDj}0ZxWv|p2er-Rm>zU-&Ld-I6L$2wg|uJ!DQ~ay)D8sg(PDfp z$PUgTSk83&+0)Dv_njvUH<`gvk%`Cm-+SY9tS+a` z3&<}_E&5xMx8LLg__#_09Nyp#&hdm85+dGbvH*SA{vNVbRQY<{k9?|iKe337CTtx8 zzHAnGZ^?fj=T~+&CdR>l4>b|Uu?e7uep^rKx!p_o?VX(PP;<)F2YtkO))_jam@)3y zoX6FEk{gGzND(l+>nPf=D-fF!#e%R<=OYZp_`mTZvuEy2sTj)4MB3|U>7PsKtJe5> zUX}@e4R~=-$rPn=@~`n9+ts2Ve;m60^!IBikP_v9>U4DI&dumtQ?GBUw}Em>(_399 zli+vQH0Hctzftqa&KRwpTgQ@Wdjbf3#vn1n&Eyh=d?5X1wB0PKlO|JCnEFinGzskb zL}A2UR1Drg>z*o_Zl|UZR=ip$jwCHAAbevo#}2VKlxN%YA9WfI+FlZWB!1OiG8);2 zg~lM6G~oBGS0svb$-WcVqZxV%D6JRApTC)qg9j@|(~Fg;785|w@Ri;6=cW%kl4{h? z?sc0b?}`xB1FFNv+7)d^O(<%gCF7B^^@mc6h1j3y&}x5>Jh@lC;Nk764-ti@aLqBz zjPcqijxS8=eNN70^CA<9%oTX=f6#t6eqCq?8&Sp%Qfl0o3usV0myur0M9cj+_xXqF zhRRnr@`H#66aK%UcEK?tE>D1)bYdJj!qU&js;Dg@6=`}mw!aTUGD}SkFW`X$m18W- zlrr#_X|W+rouY5-CECY__;t4;Wi>QH{_X(74|QGAN@L9E!F4Yo5C5fEcjKwYITT7vmDeh9+gw(ymz)m+edw>hsbPOV;aFgfxqCb*t=yZcK zG%c%_HB8?M|0gJ6dw_S+!D>BvyhN0lUS=!**N}AoQV>c}>z(EzM%e0-xj=W2RcLuB zD^e$^)}>QXG3{e~Ck(1O;~AaLyJ~>yO#9qu9JEt7a1X(+*xp>*E-Tz|u58FX=v5)Z zXrXpG$BD7Xr+W0Ma^M$U&Z%JKXqY9?UIoY}Gub#C=?~8jCu(L$cgLP_olD1U_!=3& zZ#9Y}s;u$ji4hx4=D%sD4qaKkBv@Lyyw^VX{M(f$0VK^I)-Q@zMyN3GrnJJqRhy;Y z!H0KgMtFc+l*RHXWmdOi6GAN`=1y;(r87L*soj1Bg+<<_;q4$%N8K0pOOwKAxn>ot z@mUuMq>#J8O43-0-Z(C(o7{Wm&UzLs8P-xgEaQ&7Fsy@&;fk?w)oJmXca+S9cJ*zT zX0+{gaTu2K-SRGkl>u=y68Z^VA8(h#Nn^alZ)?QHB|StADa<&aIx~y%3}M7BHs_(b zUFs_GG3SwA4G&2_)oInc4&+hgFuf(5t>jPdW|m^&*ggSJ0p8ifct*XuxA&v?DWg68 zP6^68hTtC+cmE1Xq^`fsv6#8b?_1vP)d&16w9v{cn)l6*%aYyX;av|ifTV^RTFGaG zBDJ!VYh+v0G69;8wzcA9c2*d9O1ikTxW=K*eWd}cmc=n;3i`sl^4r z=rt~^9}DtZ)a$wgIWj$xLhf8)%lMgn=Ixcc3JueOtxa=#5i{jn_OvrviEl?iU!Th3 zxuajvv}(BeUaqi)Z24Wa$zJjgl%;_&3lD}*jjzdvc11W7pejEl@F13Cvy4#-lu|v* zM(wjVoWqB29JeXNrL|S?7*MOaQJ(*)1z`#5GZ#)*jh*YNU*TcL;e7)mVwUW;4@>5$ zJ_BSWm>4vjp=A^T>MulCKknMed?aTEx!R7g3+!h?m*2--FJ9wV{?Qg69klD{=Y3-P z9T?#0Klb@ExB9c^{kd=8%4+L*6NlE!%3|-x`Mn*c=wP_wFC9aiCi&wCsZ(iVj}!%D z1J}IYVx)yzbJP;C6b@2f0|!@(w^M??(g{}ZI59sz?;_x|Cne`_5D^Z#e8 zSQv1J)Z`I!rl$ zv&m3qgO|Pc9Pjr(GJ8xCA8JSo&wIpzHv#?1$SIxW-x!Dv!)j-iT_9}|)1CI=r~GHC zZqXW{Y$b>QnYU=qP1Paf(?IHpmexWsQ$w5zTyZX=sweTA11D=q{8|H z%>^DZ<P7fIF z)WhYqSn%CEmRI%&4)1^jOw%ATq^AWdLEwrl85{ zCz+DUH}cW!U5`fUj6H8<=M?KnHj+CC255K;cXT52y9P>+Kmb!E0<@u&n;CyAI^-~AWJh+GP_M0zwEWK*8=wiER_ymWR5eVYaYDK4|91LQpl!~cC5mU z8GHHXe?CCh3{HWW(h5;?lKx+_4Ki6K#@Vb=r6Z-y+!4l+tr{N#DRLI(gA6f~?Da|D zMxhr}qQ&lPB=xU9F+fSI7}6mq?Wbv5O~nq{kIri8VzR_*`_6P6fRC|E7%#19Uu;|1 zkIOG3LlMKa#IR+$&NOT0lldO{{+ztMshqRg&PS4;GJJQdDN@@63a525<_6ysDB%T9 zYpHgTJCUJ?9{Yb%J&I-Wf#xOcGUqbA%#l99{(8e$3$DyC4r+;nRi^>)w}WU8T#ck& z!pojj^OL5nQACWnyJQsJtO&X1Ff14T4D zbOeZ(cx;L>4xd5+wouX1MlLHdWB{v0ltvZZl4dB7^5o)9u&v14q@!r>y7S{i+7G*W zc{5AD&<#UY5@FTKX4?t2@LiJc|N zj8M8Z3HeNp;tice^8qf@L_H`t!S6L}@KR8p!i=%5qdw{Y`wGLg<)=Fq_M4tebUPXr zr~U;$cw@i$9nC9f?!I!i{Jh4ZrJbIp8=2A9w`k*TYRSZu8OxPh8OrPLd0m+uNI^tf z&g8P@GkbM}tum|sCZvzVIWa&>aT8LG^+=^|#+hNm&g6_y3e!6GuW&hbQLdgx8r;dV zjU&6aB%wdg8Gnapoj~!*_m~_C2-4yZS)`ghz+5R(XNI*=1v$rlHuv21pcipW8OFH5 zi9`4U;T+{al@}Mj2*U#@3|y!JZAj?y;)F4bt!zIP;4?)?N|&ihoM%hev{@&1auyvf zQ@#Usnv=75T9z%|4KSa7iiC&Z3dxy1oDk>Fyyr*Svy2pDD(fbxMO83=xF&i1pr@KP zpyWrKHx@8MnahgXsF#Qy;uVsEZ(l{kXQ|vruP2;~CLhEBL9=F1NUMd=TW9)GhchSM z(q+L=CSF+x=L6m<;pvhs%_-`Y@{_G8(E*SI~z*{+zAB5th|Tb}|U zoq@GAw`Uqgo-EsDkDw~FrkuJGK@<%0U+ThJYUXa_S#)Qi*Ign_az>rY>3073N56Dx zG!F1m0QP2h3p4ff%y(b1HV%Dn-T==lPg=Go6ZyGCy|fx&oQgATM;Le7C()>)cx)>H zU$4vZiSFE^0K*(1@8&^2YmVaQ2-xqADNSI?DtiR>h2dvxBD)qC0fu9=$q0fWB%aa! zt#yrG5)Ut|>kZUue^)S$hTyj|EjI3C?&eB%@efS+{!O*1l(02JUzr2 zcYfZBq@i;$YgFH8oo!R20vdQ0U}xgLN1CS<`&XRL<%teDc2MHr`Wiw55Z}Umzv5V& zk;`K8_sF!#NZwXNMS5(n!POyqorx|Y%iNSMPH}-hB~9=p3Z*!Q`}nPKn-9IulzB`j zxzT+*5s)ElGt_naXezu=wX7!6GA=Nmr00gauV4LUI!y4+^zT4d*^x4zuq0K)gWKeT zdbzxsN?IL3%atn0Y`%y@R%Zu7j$rU19N;^09)5ji~uD>O&KmW)L=4>^H08I=?HZc`J1mS+rH>7ZRaG6N+rh&3f&L3V8Ubd@B6}%)VP=v@YiT2x^DEL zwebmN4(J1Kf1J_J{jA8IAKc)4Dp>VcXmMJhJrfWKh~Q}pa8+tYi=p-7V>-u42*qzS zArT8l!Xre!We4vKYr4sVGVjrvIul3~4&w*O%vNX{5I4GUi_7i?6-ZZa=uGq~2ypUs z=}3n(4O#ZO)(U8LCns7~URfoo_9eAigcHVux;-=kw~N-^BZT_>_K@-W*9XS8jq&QvhJoPn@ZssM>y4emK|_n8aXYeYhmC z`Bt-6Mv~=z#>^FC#uE5B@3IS*|I$yswuG0O)@ACmhmq7VgTEnsg;S>@^i71od_-JA zH49q6u&P5)10pX%}K#|UKA;3?IrfxVGWTW3GdQZ9{D>gGU-*)AK^TsTP1j?dFE}c!htS# zuFVAeyf@m!Dde`|3Ih=ofnZMDJ1N28MlT&Ne60MYO9*o24#%!{*TpRs_}$N>@Y{q?J+Jz+ zA~QbG0?`NHpy?Y*mR}<`*>uyvKi+{66_)`4s8BQGv*9Y5o0B5y&TyiIcI_j3?V=JZ zXI=~G+SqlxgLrr9>z?LZ0ue*M&`~6cRoFgZc6>r-5Jz@^ad!E{FOrX(4MIJN659)V ze*{g9+A(s=hZj*1NG~wbnrY6-#5|Pa(?Gk3nT$IuoPa+WuD{=MstI6?cn|BMAZ+c0$&lAqtDltM4Z z?$J#7olu(LCy|7<4=rmoPeMal9yg1&4Y_!p{LJ!(r4bLgRS{Qs)WZGkU z(66uEnZ_GF&Ao0)%8ML%+rbOdPt8aDMoJJM#tH`mqxv4X%;0GiGNHuCqu(uPso1%F zz5QmBcvg|gZz69?yi0%1`=)ijfzrtzq%2UhSwiQ3UlFbvcJ8X$dZ=MsS5E(d99m5! zfhaRP@*qb_!NL2T0nEa;4u+n>yq+_Ad=~*@z_`ZW^3HaAXjg|M`_7<8k7H za34Z+x$4`B_0!Wr9i&XS+B`eH=0Us>kXaDmKyX2P*l?WoXGF3Z5$9hY+w^Z(rqiW2?z+}bL|K9aD^P_rFVA4YMK%ar$J=|{;qu2yKRVd$Y z9H46%riGbW%c6_TVBIi19*|f0S6T-RJoLG`Tb7xdZcRM+Dl0zzpfayhP#TTp`$N=( z2ad>-rV~B5*@7$AHcRS0yNaxl%DA1Vpgg2`^zWRvT|j$%!JUkOVcBP) z{w$^b=iU;odduD`I{K&m+U-W@e~axU>s8nU0zT z#yam{R-Uvcx+DSfA7T59%AEz2wjUeZ{nm&SX$N_rb* zn{h{OAkHB#ufDFwC_jhvAvKf<_8t;AG!?tbvb?=*wW0b_>(R9!wC3kalikuyVTAY@ za1sl5_K{thmslGjYa<{9fY?PWSb#Ey1;_Wi?nL6wG`zd?nc#>0@KK=O^y|%-4e}oL zisE8K{Swwx!vpyv2rKj6Qh|@QW(MCF#v&eG#Jl=SIaVLfjUpWlvkmaf?`5(4db~v& z^^g1R#TcrB3k%?okH^noFZ{0IUtU7VCE({eqy>k@=S5$diQeaI9fQ@no@*mQtmUiN zu_oHWDXe9S8XQa%p7VtQDa&^_e;VOFg!Ak>$+C;y`3D9>2g6r}%vp0sO14=UhTxpj zX@VBqgm`q`-j`$%U}_5Wll0@U;(f&xeM+&`{tc{@VC!9J)A)j^UZG<-&|YudAK~mA zzBElp20SG7)~F{a*-qFAzo0^vU-CpIPd1^H=$FJSt+mAD6G8WldB$rut=Po~Tk(o( zZuncla;T`+v-DFy(ZkaV8Hcx3iiF30Q^ww4yNbc>*JEc>w9L&h$4L7=qElG`n@t^C ze7PN2#;M*KEo*Q_)spG2626O~UhIbqS)l&B{CZMG`>QFvm(~%-KFKlsio#4_kKRmj z(s*g()ClQU4L4V-(z;@`6r=Q)-e)2j-PVv(Phq6krtvL5i>9-*!`DyPB@`-g^;yrW zj;;0J;9IdHp1!!`i7#7`9nXxL z_AOdNs^xc_;v=eH2FkAqpgQ6Z9fqBDU&gbDABao#;cD|_efd7wtkeGNn@A;@->wFl za4^1>(ifcDxP^;*23wdOuPPr-5t>z^;RCmkDWjm*@Eq-lmjhFOGi7DlcX!83+duGC z*qMrA>w$(HRE$l|@;Qt*s+q%39Zi6eVO-2#BH5f?hdd^qYkma17dNdS*EOE*qZ5f? zp6{!CeD!hPH1-`stIGN}cA?(~0+Mqit{0Q051WTW+|K!wVfx+?~cOWkt~od6$`>FXH6A|XX2l;7IgaL3%|ama6dS` zT~**$*HNxLb+TPjttW~x&N7_e@{^x7P5t{o#~Hr^=g8n*vk}YYf~fy-doSa zj1=w_D>HZ83cg!;Qxr`zBa%-pICtHAI0py$AW)keNw6i`dhR0j3A%y~4p`u~h~TCA zdvK;3V$e9m!$E$4rAJ;>EIPP-b3+pY^n3&Iz*uPEmF$?#$9`T+m+_6wu%&hBSN=Im z-lT5U$3lUsD^(5iP)2G{u54^d2*YdVgkcpL54lAKs>xix>IM(PO;`T@a zPP|52lQlubf8l2W{HLV?0*~{H8{j5o&GlGzPT&get-J7v*mz+&v!|(2N9kskVA*O( zr4P~2IXkMQ7d-kJlRsw_)}2rY@-|i5`e=U10r^{-)q8k>o6)@Ng`zi-&Ew$_z5K|S zx*7Pwd8R278{XC{a?Er??=Ek-TW(u?p#YlD{+AC=7*&UbhXFoF84!uHIsfeF?|Ch1 zShWMk;mD-X_ukd1xR39{s`YB~OezFpF}{Z1NOR~a&q_U#H(xY^l2S#=-4cc9hbS+F zC2{&1N}y%m@pb;x58^MSQYstU8(8l4*At~MO)TESX@Tz$b-lt(j3Sob8- zOuVYo7rO4G)ff(KPT+QgA{a{kw~8?{&(3?_VrZhp>wC_>ZqV;aN?vPhIh{;M&ZXV_ z3Uk%F1RA}T!iW)3t9@{_-~R@{b-+KHfh9Ydi8<6)osQiW?GFlOo>PDoW#X#`*t%J< z$vaik7q3{39$V&FJ61WZBM9@KE&?@Kmg{&|eNf?LGpo&Wk7FV@cx%fhqo=cWFFne? z#t(2eEy1d7caweZ zj3mVtw)RGnc>pRFt)jE-TH>BWu_`b8z@v+DYb@ganKoIr7=aFUC&Ev3HXCfA6(2ej z@;hPQ?TvnQF0*S62{RVDChX*+3|?@S%;Efd21_y`z%Hc_x`lkJ@clBQpA&vzosX06 z*xxKgYkWfeb>0~Q@JKM)Oo?-rv>fE3L(CGR5@*SI6RUyem|-f7Oj~+OlQnvLe=hnn z`srD^i0a916wy-m*~^6Y?&P$*wWYcPr`53)Y9GI}$$b=({LBXd|>mbuRb?gW*o)JVxyCuHTfhM98yV!*npy;cW1#$Kcak!l4wKbQ>c*X4?5vP3E!Wuq6W8HYttz<8oJfM6hd>`n30wN|f1Ih3JC5KmbU?|k*dL;$T=nI}`%x@*R0 zI1WyULUPq70*;-VIzLWRueWU8H7R5x%OY*0Ac&Q5Li=hlQQkm&GSt7o-=2T5Ru`(J z&(PV>Uz<1GqL`Vg{7`M{yxs~RY|23#-DT>GB4D-o`P<$O*siH?8m?|T7!7!+6+zwN z7Q0kymDxidUlM9=oKho3eVZf?ewx6LJ8eX6my8y0gVwK%&8G%mHxm%FRix<761B4# zRc#*7j})vdO>utC$Sc>dhi#vqBZmY|)8i`gWs6dJv zU(5CN^Pl!vMIuZidNaH1IjJHfZktO@{ffZz9gTGG7JG)T-@)HXZf?N`Ult@@lKH|{ zhl3?U>D1KkgYF{|*^9QPdR8Q&;239>a*U7s9FK@wVfHAVwp#Id)7~ZqNh9u1mhn*) zNxuiHS1pfPkH$Og74T&V9$kc7ek8HzN@TFmJE*uuOg{FBYC%ZRsSVDSm6DS$U#j20 z11kY&xAFQuRoSP=zPA0*gqo%8=AG17nP|DZ#oLq*BA20IgEOmy#m-2tZuNgk(MKU~6O`Was_Sf*8pB-sI?R3a|01gQQ9EI4=h zqNPr9+qY@=udJKveOiY%A`*pcHG91>5pQpAQ7idA^W3v0KUlj|&%J?$FQ2GLHy4*R z;oE1+0FX>@4}6tjT&VvyLw?a|4}pI)<@IGuvo6D>M#`q-f=;a=^~sNoOvJr^KR6P4OKHg(kY9}tP1yClLwz23y zHMXO2)8U59Yesf%h$x^BuJCHU2W<5;M~IIMjec6|hU(s3#BoYHn}_dwhHJGaIE_gT z!o^sPC{9869W~ZscO3FTHtyywhnPuAf%;2>04l0TsHvq+Kab8@$0jPyNV#3hm$$Qn zbKw}LZC76OJ+=vA_6>9mgU>@jnZz2sVUmwbBNhY8UkVf{%M2fFjh@yC>wvzjD&O2W z&pvfhB{OT=rtLHB%+L-v0hgHqZMX$)o!P|J=0QBLOQq-H-Oyvt#bQ1m z0W-^2`GyUd=kOG&+-1VM+xapqKZSp_8WXZB4{uIhB5fzdu1GlfY01zX#83d z5cfV_kzR{#mxL9C-`1@}T|nJf_S->OG4P+QiXblo7NL=y!m~jn?ac=V1&kijqz`{+ zWOQaHV-SN+b;%d)OLx4*MI^AF^#sOMAD7=>Vf*YOawcAX!#=Hsu18^&pm4%Cb|X>T zb5-os?t4a=1R6{pKT@$HHRsew+h@5P_+LM%W!(+HnT;WY1wde!BTD``fYlcB{B+M^9xI?|M;Bb!`Oy(9CbkHhr9AB11@^i=RLPO^(h?gR+^u({{&2FCd?XWFUEi6;(Zz_qsoK{`wB+|^QLEYW&mk3VEWi*cioxa=^pIK zCK|2ugiW{NaC9=av|jE>R90SfF|NoKoFJR5W>5(zq`4}YY^CD+l4u@`R)Ge~>q}^A zF4HLPx;Ic6jaNElel00~gw?QeVwWE*XR5y`FOD<3JBz0v9~+Ow>Xh1=0m}yFD{0UB z8Onv%=Yl_===)4hrof54*H2R70zfup%*Q_|dn~w$W>w-3B5y1n{m>k^ z-n&AzTk>AzPBBiSYv4vv{y>h~enz?XJR;|8D|y0I7@&i?K(1K1q#K^=|AvE;3-^f~7w6k8taLb!i=3F&n8U%SfwZZ@x$UPEhBIjD!*sQ6ZqWZciVeI4cNSD_E1);w-rh%B!THnn( zHHi`YR=PsOQt+=zzY^YXWYmBs2_uD1 zZK}+00L{n{Q~by}@aq#yba|ASrO7|?aD!2Qnx~UDT3Kbhr7vUa#w@Of9eE5w>j|da zUBBRMO2y>ilxCiZ^LkU4CD!;N>#O7A4^?bfH}4XhgggEW`ZMp~rWAKrTH#@!g++B$ z`=2AYf3FY`2o(ew0nCB{42EHe@Actz<&TUIa(3 true - - + SHA256 @@ -65,18 +64,11 @@ sp0.test-nemlog-in.dk sp1.test-nemlog-in.dk true - + - - Nets DanID A/S - Morten - Bech - mdbec@nets.eu - 4 - @@ -109,6 +101,11 @@ + + + + + diff --git a/src/dk.nita.saml20/WebsiteDemo/WebsiteDemo.csproj b/src/dk.nita.saml20/WebsiteDemo/WebsiteDemo.csproj index a545bb4..d9e44a5 100644 --- a/src/dk.nita.saml20/WebsiteDemo/WebsiteDemo.csproj +++ b/src/dk.nita.saml20/WebsiteDemo/WebsiteDemo.csproj @@ -128,6 +128,7 @@ + diff --git a/src/dk.nita.saml20/WebsiteDemo/idp-metadata/oiosaml3-idp-inttest-25-11-28.xml b/src/dk.nita.saml20/WebsiteDemo/idp-metadata/oiosaml3-idp-inttest-25-11-28.xml new file mode 100644 index 0000000..cd25618 --- /dev/null +++ b/src/dk.nita.saml20/WebsiteDemo/idp-metadata/oiosaml3-idp-inttest-25-11-28.xml @@ -0,0 +1,199 @@ + + + + + + + MIIGjDCCBMCgAwIBAgIUaGLv8eOYx3cubJyI3ymai6tAXCowQQYJKoZIhvcNAQEK + MDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEF + AKIDAgEgMGsxLTArBgNVBAMMJERlbiBEYW5za2UgU3RhdCBPQ0VTIHVkc3RlZGVu + ZGUtQ0EgMTETMBEGA1UECwwKVGVzdCAtIGN0aTEYMBYGA1UECgwPRGVuIERhbnNr + ZSBTdGF0MQswCQYDVQQGEwJESzAeFw0yNTA4MjAxMzQxNDBaFw0yODA4MTkxMzQx + MzlaMIGhMR0wGwYDVQQDDBROZW1Mb2ctaW4gSWRQIC0gVGVzdDE3MDUGA1UEBRMu + VUk6REstTzpHOmEwNDBmZTI2LWNlNzgtNDMyOC1hYzBlLTI5ZWViMTJmNDZkZjEh + MB8GA1UECgwYRGlnaXRhbGlzZXJpbmdzc3R5cmVsc2VuMRcwFQYDVQRhDA5OVFJE + Sy0zNDA1MTE3ODELMAkGA1UEBhMCREswggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAw + ggGKAoIBgQCVUzcmIfK0NbJEmAQ7kFOTmXs1mkSHF0LAEFq7Ne8vpNz2H+0F5IyW + CwsBi3SByPTAEIClbIT6rLFBoMmIwjfRmAXd68zW7NYwR0N8PcR/hvtoCR1tW2Ju + KhQlKbWlaYLRvvvS3r5giIjHgEXpmv42caB76eYE3J2qWPaACOIRMXky1vCmbQpE + wqJr0S9+QDtMYh5ypVk1zX9rrY2TBbienruISBF1090uuzEQZtfiq9nZaBQAJZFl + cYLftepSZXW4QgJjWH6BhMrd4nvcz17WeabG3AhhKHvOUDukJgKMzQd/OcS1tY13 + P7soMeT8D8h5bCnNDoCfqM/5mgxgxZZXnjJhzOCY+MdrXXBRST2uQLNg0gl/Lgqm + EKk0izQaMtNauR+5fFHSJMN23Ga6fAmHMlyEj+5JhGeScRvIBp9tPERPhRF0MdEj + obbcweMRWqurJYsdo9cIHwrL8WIgQGhQRUrKBu9VPZQTtVs3dn3cxZIJ3axu53hW + EKRwqw4UoasCAwEAAaOCAYcwggGDMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAU + fyif2XGZQuJ159c1di5NCCVtdl4wewYIKwYBBQUHAQEEbzBtMEMGCCsGAQUFBzAC + hjdodHRwOi8vY2ExLmN0aS1nb3YuZGsvb2Nlcy9pc3N1aW5nLzEvY2FjZXJ0L2lz + c3VpbmcuY2VyMCYGCCsGAQUFBzABhhpodHRwOi8vY2ExLmN0aS1nb3YuZGsvb2Nz + cDAiBgNVHSAEGzAZMAgGBgQAj3oBATANBgsqgVCBKQEBAQMHATA7BggrBgEFBQcB + AwQvMC0wKwYIKwYBBQUHCwIwHwYHBACL7EkBAjAUhhJodHRwczovL3VpZC5nb3Yu + ZGswRQYDVR0fBD4wPDA6oDigNoY0aHR0cDovL2NhMS5jdGktZ292LmRrL29jZXMv + aXNzdWluZy8xL2NybC9pc3N1aW5nLmNybDAdBgNVHQ4EFgQU9KSlGZd1HK7yFmo+ + zohr4oq6LLwwDgYDVR0PAQH/BAQDAgWgMEEGCSqGSIb3DQEBCjA0oA8wDQYJYIZI + AWUDBAIBBQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAIBBQCiAwIBIAOCAYEA + Pt4QGIebeY3idMN6xPUQUBwYeiIjhtxqo2O9BHELEQ8Vp9fuBiExT286i1nNbd6T + BgFFuUPh2kuwUqAj4YfaG7aSiCToJrTuaxBGlMI9nci2l5VDJ/1/lVVT/OkMLgR9 + xVXWSi8KFT8U9S+E1THE+G1YSNnt50yRDmqGNtG1XcaXQeu2Q4IcjMc2nf7NcGzG + widsKnBv0nNXwoYnh2ZLWPjQAgQzM3EYdZmEqaCrscYDFRbh4/T3TYjOo64N4rYZ + WTR+4/poz/29tyfVBWnr3rLuJH2q0kaiFVSXRHXoqOpCDUTVwsULShjmAHcPruQK + 7mRK1NQcwJtm0HQNWKUxizqc1pA38/9tU2vkQv+OxEEwHnCRK4XkLCJ8ZKCV5+c7 + AehhTLtDHqsA93+8afgrTLe+kWEO+xRgOJxKV9TnqkvnYiG8BtCOcb4+6yUMGAoO + PULVKywIzutRsHYjZptCkuggBqNztSFU/DUd6SpSxf1MGfeh4SC4yPNvKQ+5fo7S + + + + + + + urn:oasis:names:tc:SAML:2.0:nameid-format:transient + urn:oasis:names:tc:SAML:2.0:nameid-format:persistent + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + MIIGjDCCBMCgAwIBAgIUaGLv8eOYx3cubJyI3ymai6tAXCowQQYJKoZIhvcNAQEK + MDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEF + AKIDAgEgMGsxLTArBgNVBAMMJERlbiBEYW5za2UgU3RhdCBPQ0VTIHVkc3RlZGVu + ZGUtQ0EgMTETMBEGA1UECwwKVGVzdCAtIGN0aTEYMBYGA1UECgwPRGVuIERhbnNr + ZSBTdGF0MQswCQYDVQQGEwJESzAeFw0yNTA4MjAxMzQxNDBaFw0yODA4MTkxMzQx + MzlaMIGhMR0wGwYDVQQDDBROZW1Mb2ctaW4gSWRQIC0gVGVzdDE3MDUGA1UEBRMu + VUk6REstTzpHOmEwNDBmZTI2LWNlNzgtNDMyOC1hYzBlLTI5ZWViMTJmNDZkZjEh + MB8GA1UECgwYRGlnaXRhbGlzZXJpbmdzc3R5cmVsc2VuMRcwFQYDVQRhDA5OVFJE + Sy0zNDA1MTE3ODELMAkGA1UEBhMCREswggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAw + ggGKAoIBgQCVUzcmIfK0NbJEmAQ7kFOTmXs1mkSHF0LAEFq7Ne8vpNz2H+0F5IyW + CwsBi3SByPTAEIClbIT6rLFBoMmIwjfRmAXd68zW7NYwR0N8PcR/hvtoCR1tW2Ju + KhQlKbWlaYLRvvvS3r5giIjHgEXpmv42caB76eYE3J2qWPaACOIRMXky1vCmbQpE + wqJr0S9+QDtMYh5ypVk1zX9rrY2TBbienruISBF1090uuzEQZtfiq9nZaBQAJZFl + cYLftepSZXW4QgJjWH6BhMrd4nvcz17WeabG3AhhKHvOUDukJgKMzQd/OcS1tY13 + P7soMeT8D8h5bCnNDoCfqM/5mgxgxZZXnjJhzOCY+MdrXXBRST2uQLNg0gl/Lgqm + EKk0izQaMtNauR+5fFHSJMN23Ga6fAmHMlyEj+5JhGeScRvIBp9tPERPhRF0MdEj + obbcweMRWqurJYsdo9cIHwrL8WIgQGhQRUrKBu9VPZQTtVs3dn3cxZIJ3axu53hW + EKRwqw4UoasCAwEAAaOCAYcwggGDMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAU + fyif2XGZQuJ159c1di5NCCVtdl4wewYIKwYBBQUHAQEEbzBtMEMGCCsGAQUFBzAC + hjdodHRwOi8vY2ExLmN0aS1nb3YuZGsvb2Nlcy9pc3N1aW5nLzEvY2FjZXJ0L2lz + c3VpbmcuY2VyMCYGCCsGAQUFBzABhhpodHRwOi8vY2ExLmN0aS1nb3YuZGsvb2Nz + cDAiBgNVHSAEGzAZMAgGBgQAj3oBATANBgsqgVCBKQEBAQMHATA7BggrBgEFBQcB + AwQvMC0wKwYIKwYBBQUHCwIwHwYHBACL7EkBAjAUhhJodHRwczovL3VpZC5nb3Yu + ZGswRQYDVR0fBD4wPDA6oDigNoY0aHR0cDovL2NhMS5jdGktZ292LmRrL29jZXMv + aXNzdWluZy8xL2NybC9pc3N1aW5nLmNybDAdBgNVHQ4EFgQU9KSlGZd1HK7yFmo+ + zohr4oq6LLwwDgYDVR0PAQH/BAQDAgWgMEEGCSqGSIb3DQEBCjA0oA8wDQYJYIZI + AWUDBAIBBQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAIBBQCiAwIBIAOCAYEA + Pt4QGIebeY3idMN6xPUQUBwYeiIjhtxqo2O9BHELEQ8Vp9fuBiExT286i1nNbd6T + BgFFuUPh2kuwUqAj4YfaG7aSiCToJrTuaxBGlMI9nci2l5VDJ/1/lVVT/OkMLgR9 + xVXWSi8KFT8U9S+E1THE+G1YSNnt50yRDmqGNtG1XcaXQeu2Q4IcjMc2nf7NcGzG + widsKnBv0nNXwoYnh2ZLWPjQAgQzM3EYdZmEqaCrscYDFRbh4/T3TYjOo64N4rYZ + WTR+4/poz/29tyfVBWnr3rLuJH2q0kaiFVSXRHXoqOpCDUTVwsULShjmAHcPruQK + 7mRK1NQcwJtm0HQNWKUxizqc1pA38/9tU2vkQv+OxEEwHnCRK4XkLCJ8ZKCV5+c7 + AehhTLtDHqsA93+8afgrTLe+kWEO+xRgOJxKV9TnqkvnYiG8BtCOcb4+6yUMGAoO + PULVKywIzutRsHYjZptCkuggBqNztSFU/DUd6SpSxf1MGfeh4SC4yPNvKQ+5fo7S + + + + + + urn:oasis:names:tc:SAML:2.0:nameid-format:transient + urn:oasis:names:tc:SAML:2.0:nameid-format:persistent + + + + + + + + + + + + + + + + + + + + + + NemLog-in + + + nemlogin@digst.dk + + + diff --git a/src/dk.nita.saml20/dk.nita.saml20/Bindings/HttpRedirectBindingBuilder.cs b/src/dk.nita.saml20/dk.nita.saml20/Bindings/HttpRedirectBindingBuilder.cs index 1d2bc8f..2ad1ad6 100644 --- a/src/dk.nita.saml20/dk.nita.saml20/Bindings/HttpRedirectBindingBuilder.cs +++ b/src/dk.nita.saml20/dk.nita.saml20/Bindings/HttpRedirectBindingBuilder.cs @@ -78,8 +78,9 @@ public AsymmetricAlgorithm signingKey set { // Check if the key is of a supported type. [SAMLBind] sect. 3.4.4.1 specifies this. - if (!(value is RSACryptoServiceProvider || value == null)) - throw new ArgumentException("Signing key must be an instance of RSACryptoServiceProvider."); + // Accept any RSA implementation (RSACryptoServiceProvider for legacy CSP keys, RSACng for CNG keys). + if (!(value is RSA || value == null)) + throw new ArgumentException("Signing key must be an instance of RSA."); _signingKey = value; } diff --git a/src/dk.nita.saml20/dk.nita.saml20/Bindings/SignatureProviders/RsaSha1SignatureProvider.cs b/src/dk.nita.saml20/dk.nita.saml20/Bindings/SignatureProviders/RsaSha1SignatureProvider.cs index 11650e2..032c2d9 100644 --- a/src/dk.nita.saml20/dk.nita.saml20/Bindings/SignatureProviders/RsaSha1SignatureProvider.cs +++ b/src/dk.nita.saml20/dk.nita.saml20/Bindings/SignatureProviders/RsaSha1SignatureProvider.cs @@ -7,16 +7,7 @@ internal class RsaSha1SignatureProvider : SignatureProvider { public override string SignatureUri => SignedXml.XmlDsigRSASHA1Url; public override string DigestUri => SignedXml.XmlDsigSHA1Url; - protected override byte[] SignDataIntern(RSACryptoServiceProvider key, byte[] data) - { - return key.SignData(data, new SHA1CryptoServiceProvider()); - } - - protected override bool VerifySignatureIntern(RSACryptoServiceProvider key, byte[] data, byte[] signature) - { - var hash = new SHA1Managed().ComputeHash(data); - return ((RSACryptoServiceProvider) key).VerifyHash(hash, "SHA1", signature); - } + protected override HashAlgorithmName HashName => HashAlgorithmName.SHA1; } } \ No newline at end of file diff --git a/src/dk.nita.saml20/dk.nita.saml20/Bindings/SignatureProviders/RsaSha256SignatureProvider.cs b/src/dk.nita.saml20/dk.nita.saml20/Bindings/SignatureProviders/RsaSha256SignatureProvider.cs index 6185ca7..3d4d3e2 100644 --- a/src/dk.nita.saml20/dk.nita.saml20/Bindings/SignatureProviders/RsaSha256SignatureProvider.cs +++ b/src/dk.nita.saml20/dk.nita.saml20/Bindings/SignatureProviders/RsaSha256SignatureProvider.cs @@ -7,15 +7,6 @@ internal class RsaSha256SignatureProvider : SignatureProvider { public override string SignatureUri => SignedXml.XmlDsigRSASHA256Url; public override string DigestUri => SignedXml.XmlDsigSHA256Url; - protected override byte[] SignDataIntern(RSACryptoServiceProvider key, byte[] data) - { - return key.SignData(data, new SHA256CryptoServiceProvider()); - } - - protected override bool VerifySignatureIntern(RSACryptoServiceProvider key, byte[] data, byte[] signature) - { - var hash = new SHA256Managed().ComputeHash(data); - return ((RSACryptoServiceProvider)key).VerifyHash(hash, "SHA256", signature); - } + protected override HashAlgorithmName HashName => HashAlgorithmName.SHA256; } } \ No newline at end of file diff --git a/src/dk.nita.saml20/dk.nita.saml20/Bindings/SignatureProviders/RsaSha512SignatureProvider.cs b/src/dk.nita.saml20/dk.nita.saml20/Bindings/SignatureProviders/RsaSha512SignatureProvider.cs index c2b1b86..a081f17 100644 --- a/src/dk.nita.saml20/dk.nita.saml20/Bindings/SignatureProviders/RsaSha512SignatureProvider.cs +++ b/src/dk.nita.saml20/dk.nita.saml20/Bindings/SignatureProviders/RsaSha512SignatureProvider.cs @@ -7,15 +7,6 @@ internal class RsaSha512SignatureProvider : SignatureProvider { public override string SignatureUri => SignedXml.XmlDsigRSASHA512Url; public override string DigestUri => SignedXml.XmlDsigSHA512Url; - protected override byte[] SignDataIntern(RSACryptoServiceProvider key, byte[] data) - { - return key.SignData(data, new SHA512CryptoServiceProvider()); - } - - protected override bool VerifySignatureIntern(RSACryptoServiceProvider key, byte[] data, byte[] signature) - { - var hash = new SHA512Managed().ComputeHash(data); - return ((RSACryptoServiceProvider)key).VerifyHash(hash, "SHA512", signature); - } + protected override HashAlgorithmName HashName => HashAlgorithmName.SHA512; } } \ No newline at end of file diff --git a/src/dk.nita.saml20/dk.nita.saml20/Bindings/SignatureProviders/SignatureProvider.cs b/src/dk.nita.saml20/dk.nita.saml20/Bindings/SignatureProviders/SignatureProvider.cs index 8fed0a7..0b823a1 100644 --- a/src/dk.nita.saml20/dk.nita.saml20/Bindings/SignatureProviders/SignatureProvider.cs +++ b/src/dk.nita.saml20/dk.nita.saml20/Bindings/SignatureProviders/SignatureProvider.cs @@ -15,25 +15,22 @@ internal abstract class SignatureProvider : ISignatureProvider public byte[] SignData(AsymmetricAlgorithm key, byte[] data) { - var rsa = (RSACryptoServiceProvider)key; + var rsa = ToSha2CapableRsa(key); - rsa = ConvertProviderType(rsa); - - return SignDataIntern(rsa, data); + return rsa.SignData(data, HashName, RSASignaturePadding.Pkcs1); } - protected abstract byte[] SignDataIntern(RSACryptoServiceProvider key, byte[] data); - public bool VerifySignature(AsymmetricAlgorithm key, byte[] data, byte[] signature) { - var rsa = (RSACryptoServiceProvider)key; - - rsa = ConvertProviderType(rsa); + var rsa = ToSha2CapableRsa(key); - return VerifySignatureIntern(rsa, data, signature); + return rsa.VerifyData(data, signature, HashName, RSASignaturePadding.Pkcs1); } - protected abstract bool VerifySignatureIntern(RSACryptoServiceProvider key, byte[] data, byte[] signature); + /// + /// The hash algorithm this provider uses when signing/verifying raw data such as the HTTP-Redirect query. + /// + protected abstract HashAlgorithmName HashName { get; } public void SignAssertion(XmlDocument doc, string id, X509Certificate2 cert) { @@ -72,26 +69,52 @@ private SignedXml Sign(XmlDocument doc, string id, X509Certificate2 cert) return signedXml; } - private static RSACryptoServiceProvider ConvertProviderType(RSACryptoServiceProvider rsa) + /// + /// Returns an instance guaranteed to support SHA-2, keeping the signing/verification + /// path provider-agnostic: it works with modern CNG keys () as well as legacy + /// CryptoAPI keys (). + /// + private static RSA ToSha2CapableRsa(AsymmetricAlgorithm key) { - // ProviderType == 1 is PROV_RSA_FULL provider type that only supports SHA1. Change it to PROV_RSA_AES=24 that supports SHA2 also. + var rsa = (RSA)key; + + // CNG keys already support SHA-2. + if (rsa is RSACng) + return rsa; + + var csp = rsa as RSACryptoServiceProvider; + if (csp == null) + return rsa; + + // Public keys (inbound signature verification): re-import into a CNG key, which supports + // SHA-2 regardless of the originating CSP provider type. + if (csp.PublicOnly) + { + var cng = new RSACng(); + cng.ImportParameters(csp.ExportParameters(false)); + return cng; + } + + // A private key backed by a legacy PROV_RSA_FULL (provider type 1) CSP only supports SHA-1. + // Reopen the same key container under PROV_RSA_AES (provider type 24), which supports SHA-2. // https://github.com/Microsoft/referencesource/blob/master/System.IdentityModel/System/IdentityModel/Tokens/X509AsymmetricSecurityKey.cs#L54 - if (rsa != null && rsa.CspKeyContainerInfo.ProviderType == 1) + if (csp.CspKeyContainerInfo.ProviderType == 1) { if (Trace.ShouldTrace(TraceEventType.Verbose)) + Trace.TraceData(TraceEventType.Verbose, "Reopened RSA private key under provider type 24 to enable SHA-2"); + + var cspParams = new CspParameters { - Trace.TraceData(TraceEventType.Verbose, - "Changed provider type from " + rsa.CspKeyContainerInfo.ProviderType + " to 24"); - } - CspParameters csp = new CspParameters(); - csp.ProviderType = 24; - csp.KeyContainerName = rsa.CspKeyContainerInfo.KeyContainerName; - csp.KeyNumber = (int)rsa.CspKeyContainerInfo.KeyNumber; - if (rsa.CspKeyContainerInfo.MachineKeyStore) - csp.Flags = CspProviderFlags.UseMachineKeyStore; - csp.Flags |= CspProviderFlags.UseExistingKey; - rsa = new RSACryptoServiceProvider(csp); + ProviderType = 24, + KeyContainerName = csp.CspKeyContainerInfo.KeyContainerName, + KeyNumber = (int)csp.CspKeyContainerInfo.KeyNumber + }; + if (csp.CspKeyContainerInfo.MachineKeyStore) + cspParams.Flags = CspProviderFlags.UseMachineKeyStore; + cspParams.Flags |= CspProviderFlags.UseExistingKey; + return new RSACryptoServiceProvider(cspParams); } + return rsa; } } diff --git a/src/dk.nita.saml20/dk.nita.saml20/Protocol/Saml20LogoutHandler.cs b/src/dk.nita.saml20/dk.nita.saml20/Protocol/Saml20LogoutHandler.cs index 57fdcb0..f2bda1d 100644 --- a/src/dk.nita.saml20/dk.nita.saml20/Protocol/Saml20LogoutHandler.cs +++ b/src/dk.nita.saml20/dk.nita.saml20/Protocol/Saml20LogoutHandler.cs @@ -1,6 +1,7 @@ using System; using System.Diagnostics; using System.IO; +using System.Security.Cryptography.X509Certificates; using System.Threading; using System.Web; using System.Web.Security; @@ -302,7 +303,7 @@ private void TransferClient(IDPEndPoint endpoint, HttpContext context) if (destination.Binding == SAMLBinding.REDIRECT) { HttpRedirectBindingBuilder builder = new HttpRedirectBindingBuilder(); - builder.signingKey = FederationConfig.GetConfig().GetFirstValidCertificate().PrivateKey; + builder.signingKey = FederationConfig.GetConfig().GetFirstValidCertificate().GetRSAPrivateKey(); request.Destination = destination.Url; request.Reason = Saml20Constants.Reasons.User; request.SubjectToLogOut.Value = Saml20PrincipalCache.GetSaml20AssertionLite().Subject.Value; @@ -589,7 +590,7 @@ private void HandleRequest(HttpContext context) HttpRedirectBindingBuilder builder = new HttpRedirectBindingBuilder(); builder.RelayState = context.Request.Params["RelayState"]; builder.Response = response.GetXml().OuterXml; - builder.signingKey = FederationConfig.GetConfig().GetFirstValidCertificate().PrivateKey; + builder.signingKey = FederationConfig.GetConfig().GetFirstValidCertificate().GetRSAPrivateKey(); builder.ShaHashingAlgorithm = shaHashingAlgorithm; string s = destination.Url + "?" + builder.ToQuery(); context.Response.Redirect(s, true); diff --git a/src/dk.nita.saml20/dk.nita.saml20/Protocol/Saml20SignonHandler.cs b/src/dk.nita.saml20/dk.nita.saml20/Protocol/Saml20SignonHandler.cs index 01c1b98..ce21363 100644 --- a/src/dk.nita.saml20/dk.nita.saml20/Protocol/Saml20SignonHandler.cs +++ b/src/dk.nita.saml20/dk.nita.saml20/Protocol/Saml20SignonHandler.cs @@ -409,7 +409,7 @@ private static Saml20EncryptedAssertion GetDecryptedAssertion(XmlElement elem) { var tryDecryptAssertion = new Func((certificate) => { - Saml20EncryptedAssertion decryptedAssertion = new Saml20EncryptedAssertion((RSA)certificate.PrivateKey); + Saml20EncryptedAssertion decryptedAssertion = new Saml20EncryptedAssertion(certificate.GetRSAPrivateKey()); decryptedAssertion.LoadXml(elem); decryptedAssertion.Decrypt(); return decryptedAssertion; @@ -893,7 +893,7 @@ private void TransferClient(IDPEndPoint idpEndpoint, Saml20AuthnRequest request, Trace.TraceData(TraceEventType.Information, string.Format(Tracing.SendAuthnRequest, Saml20Constants.ProtocolBindings.HTTP_Redirect, idpEndpoint.Id)); HttpRedirectBindingBuilder builder = new HttpRedirectBindingBuilder(); - builder.signingKey = _certificate.PrivateKey; + builder.signingKey = _certificate.GetRSAPrivateKey(); builder.Request = request.GetXml().OuterXml; builder.ShaHashingAlgorithm = shaHashingAlgorithm; string s = request.Destination + "?" + builder.ToQuery(); diff --git a/src/dk.nita.saml20/dk.nita.saml20/Saml20AttributeQuery.cs b/src/dk.nita.saml20/dk.nita.saml20/Saml20AttributeQuery.cs index f3acd69..bbd12a3 100644 --- a/src/dk.nita.saml20/dk.nita.saml20/Saml20AttributeQuery.cs +++ b/src/dk.nita.saml20/dk.nita.saml20/Saml20AttributeQuery.cs @@ -3,6 +3,7 @@ using System.Diagnostics; using System.IO; using System.Security.Cryptography; +using System.Security.Cryptography.X509Certificates; using System.Web; using System.Xml; using dk.nita.saml20.Bindings; @@ -220,7 +221,7 @@ public void PerformQuery(HttpContext context, IDPEndPoint endPoint, string nameI { Saml20EncryptedAssertion ass = new Saml20EncryptedAssertion( - (RSA)FederationConfig.GetConfig().GetFirstValidCertificate().PrivateKey); + FederationConfig.GetConfig().GetFirstValidCertificate().GetRSAPrivateKey()); ass.LoadXml(xmlAssertion); ass.Decrypt(); xmlAssertion = ass.Assertion.DocumentElement; From 468c7c14292a9ad5b1970f3905937d2f30b66fbd Mon Sep 17 00:00:00 2001 From: Thomas Nymand Date: Mon, 6 Jul 2026 12:40:24 +0200 Subject: [PATCH 2/4] REF-13 Trust demo SP certificate CA chain in setup (fixes #70) setup_prerequisites.ps1 imported the SP certificate into My/TrustedPeople, but the chain's root CA ended up in the Intermediate CA store rather than Trusted Root. As a result X509Chain terminated in an untrusted root and DefaultCertificateSpecification (chain + online revocation) rejected the certificate ("No valid certificates found") when the demo IdP encrypted to / validated the service provider. Add Set-CertificateChainTrust (functions.ps1): it places a PFX chain's root CA in Trusted Root and intermediates in Intermediate CA, and removes the misplaced root copy that Import-PfxCertificate leaves in Intermediate CA. Call it for serviceprovider.p12 after import. Co-Authored-By: Claude Opus 4.8 --- setup/functions.ps1 | 57 +++++++++++++++++++++++++++++++++++ setup/setup_prerequisites.ps1 | 3 ++ 2 files changed, 60 insertions(+) diff --git a/setup/functions.ps1 b/setup/functions.ps1 index a1fe2e1..369b33c 100644 --- a/setup/functions.ps1 +++ b/setup/functions.ps1 @@ -97,4 +97,61 @@ function Set-CertificatePermission { throw "Could not locate the private key file for certificate $pfxThumbPrint (checked both the CNG and CSP key stores). The certificate's key provider metadata may be inconsistent - re-import the certificate cleanly."; } +} + +function Set-CertificateChainTrust +{ + # Ensures the CA chain contained in a PFX is trusted for X.509 chain building: the root CA is placed + # in Trusted Root (LocalMachine\Root) and intermediate CAs in Intermediate CA (LocalMachine\CA). + # Import-PfxCertificate drops all CA certificates - including the root - into the Intermediate CA store, + # where a root is not a trust anchor, so any misplaced root copy is removed from Intermediate CA. + # Without this, DefaultCertificateSpecification (chain + online revocation) rejects the certificate + # because the chain terminates in an untrusted root (see GitHub issue #70). + param + ( + [Parameter(Position=1, Mandatory=$true)] + [ValidateNotNullOrEmpty()] + [string]$pfxPath, + + [Parameter(Position=2, Mandatory=$true)] + [ValidateNotNull()] + [System.Security.SecureString]$pfxPassword + ) + + $plainPassword = (New-Object System.Net.NetworkCredential('', $pfxPassword)).Password + + $chain = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection + $chain.Import($pfxPath, $plainPassword, 'DefaultKeySet') + + $intermediateStore = New-Object System.Security.Cryptography.X509Certificates.X509Store('CA', 'LocalMachine') + $rootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store('Root', 'LocalMachine') + $intermediateStore.Open('ReadWrite') + $rootStore.Open('ReadWrite') + try + { + foreach ($cert in $chain) + { + if ($cert.HasPrivateKey) { continue } # leaf (end-entity) is imported separately into My + + if ($cert.Subject -eq $cert.Issuer) + { + # Self-signed => root CA. Trust it, then remove any misplaced copy from Intermediate CA. + $rootStore.Add($cert); + $misplaced = $intermediateStore.Certificates.Find('FindByThumbprint', $cert.Thumbprint, $false); + foreach ($m in $misplaced) { $intermediateStore.Remove($m) } + write-host "Trusted root CA '$($cert.Subject)' ($($cert.Thumbprint)) in Trusted Root Certification Authorities" + } + else + { + # Intermediate CA + $intermediateStore.Add($cert); + write-host "Installed intermediate CA '$($cert.Subject)' ($($cert.Thumbprint)) in Intermediate Certification Authorities" + } + } + } + finally + { + $intermediateStore.Close() + $rootStore.Close() + } } \ No newline at end of file diff --git a/setup/setup_prerequisites.ps1 b/setup/setup_prerequisites.ps1 index cf1fcaa..15ea6ee 100644 --- a/setup/setup_prerequisites.ps1 +++ b/setup/setup_prerequisites.ps1 @@ -33,6 +33,9 @@ $serviceprovidercertificate = Import-PfxCertificate '..\certificates\serviceprov write-host "Installed serviceprovider's signing certificate $($serviceprovidercertificate.Thumbprint) in LocalMachine\My and LocalMachine\TrustedPeople. This ensures the certificate is trusted on your machine and browser" write-host "This certificate is used by the demo website (service provider) as its current signing certificate" +write-host "Trusting the serviceprovider certificate's CA chain so X.509 chain building succeeds (see GitHub issue #70)" +Set-CertificateChainTrust '..\certificates\serviceprovider.p12' $certpassword2 + #If you need to redo sslcert binding, the following statements will delete previously creates ones #"http delete sslcert ipport=0.0.0.0:20001" | netsh #"http delete sslcert ipport=0.0.0.0:20002" | netsh From 0088cab21f946cd8a67535604ed3370088c71894 Mon Sep 17 00:00:00 2001 From: Thomas Nymand Date: Mon, 6 Jul 2026 12:43:33 +0200 Subject: [PATCH 3/4] REF-13 Resolve PFX path in Set-CertificateChainTrust (fixes #70 regression) X509Certificate2Collection.Import resolves relative paths against the process working directory, not PowerShell's Set-Location ($PSScriptRoot), so '..\certificates\serviceprovider.p12' failed with "The system cannot find the path specified". Resolve to an absolute path via Resolve-Path first, matching how the Import-PfxCertificate calls behave. Co-Authored-By: Claude Opus 4.8 --- setup/functions.ps1 | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/setup/functions.ps1 b/setup/functions.ps1 index 369b33c..b44a62a 100644 --- a/setup/functions.ps1 +++ b/setup/functions.ps1 @@ -120,8 +120,13 @@ function Set-CertificateChainTrust $plainPassword = (New-Object System.Net.NetworkCredential('', $pfxPassword)).Password + # X509Certificate2Collection.Import is a raw .NET call and resolves relative paths against the process + # working directory, not PowerShell's current location (Set-Location / $PSScriptRoot). Resolve to an + # absolute path first so a relative $pfxPath works the same way as the Import-PfxCertificate calls do. + $resolvedPfxPath = (Resolve-Path -Path $pfxPath).ProviderPath + $chain = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection - $chain.Import($pfxPath, $plainPassword, 'DefaultKeySet') + $chain.Import($resolvedPfxPath, $plainPassword, 'DefaultKeySet') $intermediateStore = New-Object System.Security.Cryptography.X509Certificates.X509Store('CA', 'LocalMachine') $rootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store('Root', 'LocalMachine') From b9faaf715f9f6bdfe5df19cb146c1c4b811a0eef Mon Sep 17 00:00:00 2001 From: Thomas Nymand Date: Mon, 6 Jul 2026 13:41:47 +0200 Subject: [PATCH 4/4] REF-13 Update WebsiteDemo integration to NemLog-in Preproduction (test-devtest4) Replace the test-devtest4 IdP metadata with the current NemLog-in Preproduction (OIOSAML3 devtest4) metadata and update the WebsiteDemo project reference to match. Co-Authored-By: Claude Opus 4.8 --- .../WebsiteDemo/WebsiteDemo.csproj | 2 +- ...iosaml3-idp-devtest4-inttest-25-11-26.xml} | 144 +++++++++--------- 2 files changed, 75 insertions(+), 71 deletions(-) rename src/dk.nita.saml20/WebsiteDemo/idp-metadata/{test-devtest4-idp-metadata.xml => oiosaml3-idp-devtest4-inttest-25-11-26.xml} (62%) diff --git a/src/dk.nita.saml20/WebsiteDemo/WebsiteDemo.csproj b/src/dk.nita.saml20/WebsiteDemo/WebsiteDemo.csproj index d9e44a5..e996f46 100644 --- a/src/dk.nita.saml20/WebsiteDemo/WebsiteDemo.csproj +++ b/src/dk.nita.saml20/WebsiteDemo/WebsiteDemo.csproj @@ -128,8 +128,8 @@ + - Designer diff --git a/src/dk.nita.saml20/WebsiteDemo/idp-metadata/test-devtest4-idp-metadata.xml b/src/dk.nita.saml20/WebsiteDemo/idp-metadata/oiosaml3-idp-devtest4-inttest-25-11-26.xml similarity index 62% rename from src/dk.nita.saml20/WebsiteDemo/idp-metadata/test-devtest4-idp-metadata.xml rename to src/dk.nita.saml20/WebsiteDemo/idp-metadata/oiosaml3-idp-devtest4-inttest-25-11-26.xml index 850cc49..197f764 100644 --- a/src/dk.nita.saml20/WebsiteDemo/idp-metadata/test-devtest4-idp-metadata.xml +++ b/src/dk.nita.saml20/WebsiteDemo/idp-metadata/oiosaml3-idp-devtest4-inttest-25-11-26.xml @@ -3,41 +3,43 @@ - MIIGYjCCBUqgAwIBAgIEX6YiGjANBgkqhkiG9w0BAQsFADBJMQswCQYDVQQGEwJE - SzESMBAGA1UECgwJVFJVU1QyNDA4MSYwJAYDVQQDDB1UUlVTVDI0MDggU3lzdGVt - dGVzdCBYWFhJViBDQTAeFw0yMjA5MTQwNzIyMTBaFw0yNTA5MTQwNzIxNTdaMIGa - MQswCQYDVQQGEwJESzExMC8GA1UECgwoRGlnaXRhbGlzZXJpbmdzc3R5cmVsc2Vu - IC8vIENWUjozNDA1MTE3ODFYMCAGA1UEBRMZQ1ZSOjM0MDUxMTc4LVVJRDo0MTIx - OTIwNDA0BgNVBAMMLURpZ2l0YWxpc2VyaW5nc3N0eXJlbHNlbiAtIE5lbUxvZy1p - biBJZFAgVGVzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIF+TEZl - CFr6gdnEN1CJj8cPzsaDAoReDGtf4x5NfOaXdpimBGtRwX6Rbv79fAzJe5Ci5Wwn - FdQrWk8ykXufyyjsKAtGc1EI4BRLXOW6slISZSN1GpI9l1DehE0I2J7t9Ov1crh7 - i1AnZDf58FRwLtnOI8FzO3bYvQoA3MNUMam58XwFtpnNbThacUfEkS4gAZx1sdND - zosAdyj4uKZGfCkEkp6XTs26EOJzTBmEl6bQxxqZyD1/hzS8YgIF0807MvOmGXze - oxP8IRF0bWNJtK9euCsUYWz0gfJtJqzgOFaPxEPrNo0ptvEjQHayZ81LvJXQocn7 - enl4Bix6AkUm02cCAwEAAaOCAv4wggL6MA4GA1UdDwEB/wQEAwIDuDCBlwYIKwYB - BQUHAQEEgYowgYcwPAYIKwYBBQUHMAGGMGh0dHA6Ly9vY3NwLnN5c3RlbXRlc3Qz - NC50cnVzdDI0MDguY29tL3Jlc3BvbmRlcjBHBggrBgEFBQcwAoY7aHR0cDovL3Yu - YWlhLnN5c3RlbXRlc3QzNC50cnVzdDI0MDguY29tL3N5c3RlbXRlc3QzNC1jYS5j - ZXIwggEgBgNVHSAEggEXMIIBEzCCAQ8GDSsGAQQBgfRRAgQGAwUwgf0wLwYIKwYB - BQUHAgEWI2h0dHA6Ly93d3cudHJ1c3QyNDA4LmNvbS9yZXBvc2l0b3J5MIHJBggr - BgEFBQcCAjCBvDAMFgVEYW5JRDADAgEBGoGrRGFuSUQgdGVzdCBjZXJ0aWZpa2F0 - ZXIgZnJhIGRlbm5lIENBIHVkc3RlZGVzIHVuZGVyIE9JRCAxLjMuNi4xLjQuMS4z - MTMxMy4yLjQuNi4zLjUuIERhbklEIHRlc3QgY2VydGlmaWNhdGVzIGZyb20gdGhp - cyBDQSBhcmUgaXNzdWVkIHVuZGVyIE9JRCAxLjMuNi4xLjQuMS4zMTMxMy4yLjQu - Ni4zLjUuMC8GA1UdEQQoMCaBJHRob21hcy5ueW1hbmRAZXh0ZXJuYWwubmV4aWdy - b3VwLmNvbTCBrQYDVR0fBIGlMIGiMDygOqA4hjZodHRwOi8vY3JsLnN5c3RlbXRl - c3QzNC50cnVzdDI0MDguY29tL3N5c3RlbXRlc3QzNC5jcmwwYqBgoF6kXDBaMQsw - CQYDVQQGEwJESzESMBAGA1UECgwJVFJVU1QyNDA4MSYwJAYDVQQDDB1UUlVTVDI0 - MDggU3lzdGVtdGVzdCBYWFhJViBDQTEPMA0GA1UEAwwGQ1JMNTc4MB8GA1UdIwQY - MBaAFM1saJc5chmkNatk6vQRo4GH+Gk7MB0GA1UdDgQWBBTkIBjQrTbrUa+YkuWT - mQcyrcaAlDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQCltmRhlf28jwPZ - nKz3exV2SotGGzmijDrK/1gndcx5ld8C556CjB8k3UplHSGJ1Sw60LGylvi33lsZ - 6kLL7lIEtzokMFXouNFwIA5+b6/GF5r7G3hvxiyrzkZnRT7DCznV5cNtlGlZC4yM - TQK4czYLnGGWutNtsKnrWMDoLsmHewNBetgPNt8hep/g3Xx5903gcOaitfT0VQkt - iVZvLzveuqitWkHedzwVj+1QlBBIxaR+zmm0JccPIYUCv3xaI+TSDsOY1ROzkDaX - uoHghyNk7qwsMPdnY50NmmAo68mnuEC7utRK/OqkGQ6UULHU9OzWxGzVljcQ5QLz - Blt+6WFR + + MIIGjDCCBMCgAwIBAgIUaGLv8eOYx3cubJyI3ymai6tAXCowQQYJKoZIhvcNAQEK + MDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEF + AKIDAgEgMGsxLTArBgNVBAMMJERlbiBEYW5za2UgU3RhdCBPQ0VTIHVkc3RlZGVu + ZGUtQ0EgMTETMBEGA1UECwwKVGVzdCAtIGN0aTEYMBYGA1UECgwPRGVuIERhbnNr + ZSBTdGF0MQswCQYDVQQGEwJESzAeFw0yNTA4MjAxMzQxNDBaFw0yODA4MTkxMzQx + MzlaMIGhMR0wGwYDVQQDDBROZW1Mb2ctaW4gSWRQIC0gVGVzdDE3MDUGA1UEBRMu + VUk6REstTzpHOmEwNDBmZTI2LWNlNzgtNDMyOC1hYzBlLTI5ZWViMTJmNDZkZjEh + MB8GA1UECgwYRGlnaXRhbGlzZXJpbmdzc3R5cmVsc2VuMRcwFQYDVQRhDA5OVFJE + Sy0zNDA1MTE3ODELMAkGA1UEBhMCREswggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAw + ggGKAoIBgQCVUzcmIfK0NbJEmAQ7kFOTmXs1mkSHF0LAEFq7Ne8vpNz2H+0F5IyW + CwsBi3SByPTAEIClbIT6rLFBoMmIwjfRmAXd68zW7NYwR0N8PcR/hvtoCR1tW2Ju + KhQlKbWlaYLRvvvS3r5giIjHgEXpmv42caB76eYE3J2qWPaACOIRMXky1vCmbQpE + wqJr0S9+QDtMYh5ypVk1zX9rrY2TBbienruISBF1090uuzEQZtfiq9nZaBQAJZFl + cYLftepSZXW4QgJjWH6BhMrd4nvcz17WeabG3AhhKHvOUDukJgKMzQd/OcS1tY13 + P7soMeT8D8h5bCnNDoCfqM/5mgxgxZZXnjJhzOCY+MdrXXBRST2uQLNg0gl/Lgqm + EKk0izQaMtNauR+5fFHSJMN23Ga6fAmHMlyEj+5JhGeScRvIBp9tPERPhRF0MdEj + obbcweMRWqurJYsdo9cIHwrL8WIgQGhQRUrKBu9VPZQTtVs3dn3cxZIJ3axu53hW + EKRwqw4UoasCAwEAAaOCAYcwggGDMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAU + fyif2XGZQuJ159c1di5NCCVtdl4wewYIKwYBBQUHAQEEbzBtMEMGCCsGAQUFBzAC + hjdodHRwOi8vY2ExLmN0aS1nb3YuZGsvb2Nlcy9pc3N1aW5nLzEvY2FjZXJ0L2lz + c3VpbmcuY2VyMCYGCCsGAQUFBzABhhpodHRwOi8vY2ExLmN0aS1nb3YuZGsvb2Nz + cDAiBgNVHSAEGzAZMAgGBgQAj3oBATANBgsqgVCBKQEBAQMHATA7BggrBgEFBQcB + AwQvMC0wKwYIKwYBBQUHCwIwHwYHBACL7EkBAjAUhhJodHRwczovL3VpZC5nb3Yu + ZGswRQYDVR0fBD4wPDA6oDigNoY0aHR0cDovL2NhMS5jdGktZ292LmRrL29jZXMv + aXNzdWluZy8xL2NybC9pc3N1aW5nLmNybDAdBgNVHQ4EFgQU9KSlGZd1HK7yFmo+ + zohr4oq6LLwwDgYDVR0PAQH/BAQDAgWgMEEGCSqGSIb3DQEBCjA0oA8wDQYJYIZI + AWUDBAIBBQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAIBBQCiAwIBIAOCAYEA + Pt4QGIebeY3idMN6xPUQUBwYeiIjhtxqo2O9BHELEQ8Vp9fuBiExT286i1nNbd6T + BgFFuUPh2kuwUqAj4YfaG7aSiCToJrTuaxBGlMI9nci2l5VDJ/1/lVVT/OkMLgR9 + xVXWSi8KFT8U9S+E1THE+G1YSNnt50yRDmqGNtG1XcaXQeu2Q4IcjMc2nf7NcGzG + widsKnBv0nNXwoYnh2ZLWPjQAgQzM3EYdZmEqaCrscYDFRbh4/T3TYjOo64N4rYZ + WTR+4/poz/29tyfVBWnr3rLuJH2q0kaiFVSXRHXoqOpCDUTVwsULShjmAHcPruQK + 7mRK1NQcwJtm0HQNWKUxizqc1pA38/9tU2vkQv+OxEEwHnCRK4XkLCJ8ZKCV5+c7 + AehhTLtDHqsA93+8afgrTLe+kWEO+xRgOJxKV9TnqkvnYiG8BtCOcb4+6yUMGAoO + PULVKywIzutRsHYjZptCkuggBqNztSFU/DUd6SpSxf1MGfeh4SC4yPNvKQ+5fo7S + @@ -82,41 +84,43 @@ - MIIGYjCCBUqgAwIBAgIEX6YiGjANBgkqhkiG9w0BAQsFADBJMQswCQYDVQQGEwJE - SzESMBAGA1UECgwJVFJVU1QyNDA4MSYwJAYDVQQDDB1UUlVTVDI0MDggU3lzdGVt - dGVzdCBYWFhJViBDQTAeFw0yMjA5MTQwNzIyMTBaFw0yNTA5MTQwNzIxNTdaMIGa - MQswCQYDVQQGEwJESzExMC8GA1UECgwoRGlnaXRhbGlzZXJpbmdzc3R5cmVsc2Vu - IC8vIENWUjozNDA1MTE3ODFYMCAGA1UEBRMZQ1ZSOjM0MDUxMTc4LVVJRDo0MTIx - OTIwNDA0BgNVBAMMLURpZ2l0YWxpc2VyaW5nc3N0eXJlbHNlbiAtIE5lbUxvZy1p - biBJZFAgVGVzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIF+TEZl - CFr6gdnEN1CJj8cPzsaDAoReDGtf4x5NfOaXdpimBGtRwX6Rbv79fAzJe5Ci5Wwn - FdQrWk8ykXufyyjsKAtGc1EI4BRLXOW6slISZSN1GpI9l1DehE0I2J7t9Ov1crh7 - i1AnZDf58FRwLtnOI8FzO3bYvQoA3MNUMam58XwFtpnNbThacUfEkS4gAZx1sdND - zosAdyj4uKZGfCkEkp6XTs26EOJzTBmEl6bQxxqZyD1/hzS8YgIF0807MvOmGXze - oxP8IRF0bWNJtK9euCsUYWz0gfJtJqzgOFaPxEPrNo0ptvEjQHayZ81LvJXQocn7 - enl4Bix6AkUm02cCAwEAAaOCAv4wggL6MA4GA1UdDwEB/wQEAwIDuDCBlwYIKwYB - BQUHAQEEgYowgYcwPAYIKwYBBQUHMAGGMGh0dHA6Ly9vY3NwLnN5c3RlbXRlc3Qz - NC50cnVzdDI0MDguY29tL3Jlc3BvbmRlcjBHBggrBgEFBQcwAoY7aHR0cDovL3Yu - YWlhLnN5c3RlbXRlc3QzNC50cnVzdDI0MDguY29tL3N5c3RlbXRlc3QzNC1jYS5j - ZXIwggEgBgNVHSAEggEXMIIBEzCCAQ8GDSsGAQQBgfRRAgQGAwUwgf0wLwYIKwYB - BQUHAgEWI2h0dHA6Ly93d3cudHJ1c3QyNDA4LmNvbS9yZXBvc2l0b3J5MIHJBggr - BgEFBQcCAjCBvDAMFgVEYW5JRDADAgEBGoGrRGFuSUQgdGVzdCBjZXJ0aWZpa2F0 - ZXIgZnJhIGRlbm5lIENBIHVkc3RlZGVzIHVuZGVyIE9JRCAxLjMuNi4xLjQuMS4z - MTMxMy4yLjQuNi4zLjUuIERhbklEIHRlc3QgY2VydGlmaWNhdGVzIGZyb20gdGhp - cyBDQSBhcmUgaXNzdWVkIHVuZGVyIE9JRCAxLjMuNi4xLjQuMS4zMTMxMy4yLjQu - Ni4zLjUuMC8GA1UdEQQoMCaBJHRob21hcy5ueW1hbmRAZXh0ZXJuYWwubmV4aWdy - b3VwLmNvbTCBrQYDVR0fBIGlMIGiMDygOqA4hjZodHRwOi8vY3JsLnN5c3RlbXRl - c3QzNC50cnVzdDI0MDguY29tL3N5c3RlbXRlc3QzNC5jcmwwYqBgoF6kXDBaMQsw - CQYDVQQGEwJESzESMBAGA1UECgwJVFJVU1QyNDA4MSYwJAYDVQQDDB1UUlVTVDI0 - MDggU3lzdGVtdGVzdCBYWFhJViBDQTEPMA0GA1UEAwwGQ1JMNTc4MB8GA1UdIwQY - MBaAFM1saJc5chmkNatk6vQRo4GH+Gk7MB0GA1UdDgQWBBTkIBjQrTbrUa+YkuWT - mQcyrcaAlDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQCltmRhlf28jwPZ - nKz3exV2SotGGzmijDrK/1gndcx5ld8C556CjB8k3UplHSGJ1Sw60LGylvi33lsZ - 6kLL7lIEtzokMFXouNFwIA5+b6/GF5r7G3hvxiyrzkZnRT7DCznV5cNtlGlZC4yM - TQK4czYLnGGWutNtsKnrWMDoLsmHewNBetgPNt8hep/g3Xx5903gcOaitfT0VQkt - iVZvLzveuqitWkHedzwVj+1QlBBIxaR+zmm0JccPIYUCv3xaI+TSDsOY1ROzkDaX - uoHghyNk7qwsMPdnY50NmmAo68mnuEC7utRK/OqkGQ6UULHU9OzWxGzVljcQ5QLz - Blt+6WFR + + MIIGjDCCBMCgAwIBAgIUaGLv8eOYx3cubJyI3ymai6tAXCowQQYJKoZIhvcNAQEK + MDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEF + AKIDAgEgMGsxLTArBgNVBAMMJERlbiBEYW5za2UgU3RhdCBPQ0VTIHVkc3RlZGVu + ZGUtQ0EgMTETMBEGA1UECwwKVGVzdCAtIGN0aTEYMBYGA1UECgwPRGVuIERhbnNr + ZSBTdGF0MQswCQYDVQQGEwJESzAeFw0yNTA4MjAxMzQxNDBaFw0yODA4MTkxMzQx + MzlaMIGhMR0wGwYDVQQDDBROZW1Mb2ctaW4gSWRQIC0gVGVzdDE3MDUGA1UEBRMu + VUk6REstTzpHOmEwNDBmZTI2LWNlNzgtNDMyOC1hYzBlLTI5ZWViMTJmNDZkZjEh + MB8GA1UECgwYRGlnaXRhbGlzZXJpbmdzc3R5cmVsc2VuMRcwFQYDVQRhDA5OVFJE + Sy0zNDA1MTE3ODELMAkGA1UEBhMCREswggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAw + ggGKAoIBgQCVUzcmIfK0NbJEmAQ7kFOTmXs1mkSHF0LAEFq7Ne8vpNz2H+0F5IyW + CwsBi3SByPTAEIClbIT6rLFBoMmIwjfRmAXd68zW7NYwR0N8PcR/hvtoCR1tW2Ju + KhQlKbWlaYLRvvvS3r5giIjHgEXpmv42caB76eYE3J2qWPaACOIRMXky1vCmbQpE + wqJr0S9+QDtMYh5ypVk1zX9rrY2TBbienruISBF1090uuzEQZtfiq9nZaBQAJZFl + cYLftepSZXW4QgJjWH6BhMrd4nvcz17WeabG3AhhKHvOUDukJgKMzQd/OcS1tY13 + P7soMeT8D8h5bCnNDoCfqM/5mgxgxZZXnjJhzOCY+MdrXXBRST2uQLNg0gl/Lgqm + EKk0izQaMtNauR+5fFHSJMN23Ga6fAmHMlyEj+5JhGeScRvIBp9tPERPhRF0MdEj + obbcweMRWqurJYsdo9cIHwrL8WIgQGhQRUrKBu9VPZQTtVs3dn3cxZIJ3axu53hW + EKRwqw4UoasCAwEAAaOCAYcwggGDMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAU + fyif2XGZQuJ159c1di5NCCVtdl4wewYIKwYBBQUHAQEEbzBtMEMGCCsGAQUFBzAC + hjdodHRwOi8vY2ExLmN0aS1nb3YuZGsvb2Nlcy9pc3N1aW5nLzEvY2FjZXJ0L2lz + c3VpbmcuY2VyMCYGCCsGAQUFBzABhhpodHRwOi8vY2ExLmN0aS1nb3YuZGsvb2Nz + cDAiBgNVHSAEGzAZMAgGBgQAj3oBATANBgsqgVCBKQEBAQMHATA7BggrBgEFBQcB + AwQvMC0wKwYIKwYBBQUHCwIwHwYHBACL7EkBAjAUhhJodHRwczovL3VpZC5nb3Yu + ZGswRQYDVR0fBD4wPDA6oDigNoY0aHR0cDovL2NhMS5jdGktZ292LmRrL29jZXMv + aXNzdWluZy8xL2NybC9pc3N1aW5nLmNybDAdBgNVHQ4EFgQU9KSlGZd1HK7yFmo+ + zohr4oq6LLwwDgYDVR0PAQH/BAQDAgWgMEEGCSqGSIb3DQEBCjA0oA8wDQYJYIZI + AWUDBAIBBQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAIBBQCiAwIBIAOCAYEA + Pt4QGIebeY3idMN6xPUQUBwYeiIjhtxqo2O9BHELEQ8Vp9fuBiExT286i1nNbd6T + BgFFuUPh2kuwUqAj4YfaG7aSiCToJrTuaxBGlMI9nci2l5VDJ/1/lVVT/OkMLgR9 + xVXWSi8KFT8U9S+E1THE+G1YSNnt50yRDmqGNtG1XcaXQeu2Q4IcjMc2nf7NcGzG + widsKnBv0nNXwoYnh2ZLWPjQAgQzM3EYdZmEqaCrscYDFRbh4/T3TYjOo64N4rYZ + WTR+4/poz/29tyfVBWnr3rLuJH2q0kaiFVSXRHXoqOpCDUTVwsULShjmAHcPruQK + 7mRK1NQcwJtm0HQNWKUxizqc1pA38/9tU2vkQv+OxEEwHnCRK4XkLCJ8ZKCV5+c7 + AehhTLtDHqsA93+8afgrTLe+kWEO+xRgOJxKV9TnqkvnYiG8BtCOcb4+6yUMGAoO + PULVKywIzutRsHYjZptCkuggBqNztSFU/DUd6SpSxf1MGfeh4SC4yPNvKQ+5fo7S +