Skip to content

Read spidL from SAMLRequest Authentication Extensions (highest priority) #94

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Copilot wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Read spidL from SAMLRequest Authentication Extensions (highest priority) #94

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6f77807
Initial plan
Copilot Jul 9, 2026
13d2604
Read spidL from SAMLRequest Authentication Extensions (highest priority)
Copilot Jul 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 48 additions & 0 deletions WebApps/Proxy/Microsoft.SPID.Proxy/Models/Extensions/RequestSAMLAsXMLExtensions.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -207,6 +207,54 @@ public static XmlDocument AddExtensionsAndPurposeIfNotPresent(this XmlDocument s
return samlRequest;
}

public static string GetSpidLFromExtensions(this XmlDocument samlRequest,
string extensionsElementName,
string spidLElementName)
{
if (samlRequest == null || samlRequest.DocumentElement == null)
{
return null;
}

// If the element name is prefixed, search with prefix; otherwise search only by local name
XmlNodeList extensionElements;
if (extensionsElementName.Contains(":"))
{
extensionElements = samlRequest.GetElementsByTagName(extensionsElementName);
}
else
{
extensionElements = samlRequest.GetElementsByTagName(extensionsElementName, "*");
}

if (extensionElements == null || extensionElements.Count == 0)
{
return null;
}

// Look for spidL element in the first Extensions element
XmlElement extensionsElement = extensionElements[0] as XmlElement;
if (extensionsElement != null)
{
XmlNodeList spidLElements;
if (spidLElementName.Contains(":"))
{
spidLElements = extensionsElement.GetElementsByTagName(spidLElementName);
}
else
{
spidLElements = extensionsElement.GetElementsByTagName(spidLElementName, "*");
}

if (spidLElements != null && spidLElements.Count > 0)
{
return spidLElements[0].InnerText?.Trim();
}
}

return null;
}

public static string GetSpidACSFromExtensions(this XmlDocument samlRequest,
string extensionsElementName,
string spidACSElementName)
Expand Down
1 change: 1 addition & 0 deletions WebApps/Proxy/Microsoft.SPID.Proxy/Models/Options/SPIDOptions.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,4 +21,5 @@ public class SPIDOptions

public string ExtensionsElementName { get; set; } = "samlp:Extensions";
public string PurposeElementName { get; set; } = "spid:Purpose";
public string SpidLElementName { get; set; } = "ext:spidL";
}
2 changes: 1 addition & 1 deletion WebApps/Proxy/Microsoft.SPID.Proxy/Services/ISPIDService.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ public interface ISPIDService
int GetSPIDAttributeConsumigServiceValue(NameValueCollection refererQueryString, NameValueCollection relayQueryString, NameValueCollection wctxQueryString, XmlDocument requestAsXml);
int GetCIEAttributeConsumigServiceValue(NameValueCollection refererQueryString, NameValueCollection relayQueryString, NameValueCollection wctxQueryString);

int GetSPIDLValue(NameValueCollection refererQueryString, NameValueCollection relayQueryString, NameValueCollection wctxQueryString, bool isCie);
int GetSPIDLValue(NameValueCollection refererQueryString, NameValueCollection relayQueryString, NameValueCollection wctxQueryString, bool isCie, XmlDocument requestAsXml = null);
string GetComparisonValue(NameValueCollection refererQueryString, NameValueCollection relayQueryString, NameValueCollection wctxQueryString, bool isCie);
string GetPurposeValue(NameValueCollection refererQueryString, NameValueCollection relayQueryString, NameValueCollection wctxQueryString);
bool IsSpidLValid(NameValueCollection queryStringCollection, string origin = "");
Expand Down
2 changes: 1 addition & 1 deletion WebApps/Proxy/Microsoft.SPID.Proxy/Services/Implementations/FederatorRequestService.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,7 @@ private XmlDocument SetOutcomingSAMLXmlSignIn(FederatorRequest federatorRequest,
string entityId = GetNewEntityId(federatorRequest);
requestAsXml.ChangeIssuer(entityId);

var spidL = _spidService.GetSPIDLValue(refererQueryString, relayQueryString, wctxQueryString, federatorRequest.IsCIE());
var spidL = _spidService.GetSPIDLValue(refererQueryString, relayQueryString, wctxQueryString, federatorRequest.IsCIE(), requestAsXml);
var comparison = _spidService.GetComparisonValue(refererQueryString, relayQueryString, wctxQueryString, federatorRequest.IsCIE());

//If no RequestedAuthnContext is already present, add it
Expand Down
25 changes: 24 additions & 1 deletion WebApps/Proxy/Microsoft.SPID.Proxy/Services/Implementations/SPIDService.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -267,10 +267,33 @@ public int GetCIEAttributeConsumigServiceValue(NameValueCollection refererQueryS
}


public int GetSPIDLValue(NameValueCollection refererQueryString, NameValueCollection relayQueryString, NameValueCollection wctxQueryString, bool isCie)
public int GetSPIDLValue(NameValueCollection refererQueryString, NameValueCollection relayQueryString, NameValueCollection wctxQueryString, bool isCie, XmlDocument requestAsXml = null)
{
var spidL = isCie ? _cieOptions.DefaultSPIDL : _spidOptions.DefaultSPIDL;

// First, try to get spidL from SAMLRequest Extensions (highest priority)
if (requestAsXml != null)
{
try
{
var spidLFromExtensions = requestAsXml.GetSpidLFromExtensions(
_spidOptions.ExtensionsElementName,
_spidOptions.SpidLElementName);

if (!string.IsNullOrWhiteSpace(spidLFromExtensions)
&& int.TryParse(spidLFromExtensions, out int parsedValue)
&& _spidOptions.ValidSPIDL.Contains(parsedValue))
{
_logger.LogDebug("Using spidL from SAMLRequest Extensions: {spidLValue}", parsedValue);
return parsedValue;
}
}
catch (Exception ex)
{
_logger.LogWarning(ex, "Error extracting spidL from SAMLRequest Extensions, falling back to other methods");
}
}

if(_spidOptions.DisableSpidLevelFromReferer)
{
return spidL;
Expand Down
3 changes: 2 additions & 1 deletion WebApps/Proxy/Microsoft.SPID.Proxy/appsettings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,8 @@
"AssertionIssueInstantToleranceMins": 15,
"DisableSpidLevelFromReferer": false,
"ExtensionsElementName": "samlp:Extensions",
"PurposeElementName": "spid:Purpose"
"PurposeElementName": "spid:Purpose",
"SpidLElementName": "ext:spidL"
},
"cie": {
"DefaultSPIDL": 3,
Expand Down
Loading