Search code examples
itfoxtec-identity-saml2

ITfoxtec.Identity.Saml2 library - is there a way to ignore invalid SAML signatures?

I'm using the ITfoxtec.Identity.Saml2 library to add SSO to a service.

I have a use-case where I'd like to ignore errors caused by expired certificates when accepting SAML requests. At the moment I get an exception, "Signature is invalid".

Is this possible? If so, how? I've had a look through the library's source and can see there are some signature-checking methods that take a "bool validate" parameter, but I've not been able to figure out if it's ultimately possible to do what I want via the API.

Solution

  • The signature is not validated on read where the "bool validate" parameter is used. The signature validation can not be disabled or changed. Unless you make some code changes.