7

We've setup SFDC as an IdP for SSO 2.0 with another .Net application. The ACS URL, for now, is configured as a VF page which just does a System.debug() on the SAMLResponse

We picked up the value from Debug Logs and tried to validate it using ComponentSpace, a .Net tool. This is what we found:

  1. The SAML is valid
  2. The SAML has a valid signature
  3. The public key certificate in the SAML is the same as the certificate file we download from the org
  4. BUT, the SAML is signed with the private key of neither the certificate file nor the public key sent in the SAML

From 3,4 can we conclude that Salesforce is signing but with a different certificate but sending the wrong public key in the response?!

Sample SAML is here http://pastebin.com/J8FTxnhJ

What am I missing?

Edit:

We are able to validate the request if we don't decode it from Base64. But the information seems to be intact when we decode but still not valid (according to ComponentSpace)

2

If it has a valid signature, that means the public key used to validate it corresponds to the private key that it was signed with.

1

We are able to validate the request if we don't decode it from Base64. But the information seems to be intact when we decode but still not valid (according to ComponentSpace)

  • LVS, you should add this as an edit to your original question. – Mike Chale Oct 31 '13 at 15:11
  • @MikeChale I guess you're right. But we've kind of reached a state where we've accepted this as the solution! No response from Premier Support – Vid L Nov 2 '13 at 1:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.