Added session store provider for Sql Server to support web farms. setting 'SessionCookieName' which allows control over the name of the session cookie Enforce on Service Provider since it's not supported otherwises Improved error messages and handling in common configuration/setup mistakes 2.0.1 2017-12-14 Made ConfigurationInstance<T>.GetConfig() thread safe. 2.0.2 2018-04-16 support for SHA2 signatures when signing XML. Previous it was stated that this library can be used with .Net 4.5 and up. That was wrong. This library needs minimum .Net 4.6.2 in order to support SHA2 signatures in combination with XML. Version 2.0.1 still works with SHA256 out of the box with .Net 4.7.1. This version is necessary if you want to control the algorithm yourself or are running version 4.6.2 – 4.7.0 of the .Net framework. new configuration option “MetaDataShaHashingAlgorithm” under the “Federation” configuration section. This setting can be used to determine what algorithm to use when signing the service provider metadata. 3 Prerequisites 3.1 General prerequisites  IIS must be running asp.net 4.0 mode. 3.2 Prerequisites for the binary distribution  .NET 4.5 runtime or later.  ASP.NET 4.0 or 3.3 Prerequisites for the source distribution Same as the binary distribution plus Visual Studio 2017
5.3 Demonstrating IdP Discovery using Common Domain Cookie Note: Features related to Common Domain Cookie is not being actively maintained, neither in the codebase or this documentation. Since NemLog-in does not use Common Domain Cookie, it’s highly unlikely you would use this feature. This section illustrates how to perform IdP Discovery as describe in the SAML Identity Provider Discovery Profile by enabling the Common Domain Cookie approach in the Federation. Note that IdP Discovery is only relevant when multiple IdPs are present in the same federation. The setup explained in this section corresponds to the configuration illustrated in the first figure in chapter 11, which consists of two Service Providers and two Identity Providers. It is assumed that the certificates are already installed as explained in section 5.1. 5.3.1 Preparation Create the directory ”C:\inetpub\cdctest”. Copy the “dk.nita.saml20\WebsiteDemo” and “dk.nita.saml20\IdentityProviderDemo” directories to the “C:\inetpub\cdctest” directory. Rename the “WebsiteDemo” folder to “sp1” and the “IdentityProviderDemo” folder to “idp”. Make a copy of the “sp1” folder and name the new copy “sp2”. Open the IIS Manager and add three new Sites: One demosp1 that points to Service Provider 1, the sp1 directory. One named demosp2 that points to Service Provider 2, the sp2 directory. And finally one named demoidp pointing to the Identity Provider, the idp directory. In the IIS Manager edit the bindings for the three sites: For Service Provider 1: Add the entries: demosp1.commondomain.local demosp1.local For Service Provider 2: Add the entries: demosp2.local Identity Provider: Add the entry: commondomain.local (Note that the Identity Provider must be located on the domain corresponding to the common domain. This is not a requirement for Identity Providers in general, but is the only way to make it work with the Demo IdP. 7. Add the following entries to the hosts file (C:\Windows\System32\drivers\etc\hosts): 127.0.0.1 127.0.0.1
Endpoint type HTTP Handler class Sign on dk.nita.saml20.protocol.Saml20SignonHandler Logout dk.nita.saml20.protocol.Saml20LogoutHandler Metadata dk.nita.saml20.protocol.Saml20MetadataHandler A service provider installation must have all 3 handlers installed. The metadata endpoint can be removed once the service provider’s configuration is finalized and its metadata file has been downloaded. Furthermore are two extra endpoints, of which at least one is necessary to install if common domain cookie reading is enabled (more details about this in chapter 11): Endpoint type HTTP Handler class Local cookie reading dk.nita.saml20.protocol.Saml20CDCReader IdP cookie writer return point dk.nita.saml20.protocol.SAML20CDCIdPReturnPoint ASP.NET provides (at two ways to add HTTP handlers to a web application Web.config HTTP handlers can be added to a web application by adding them in the <httpHandlers> section of web.config. Consult the MSDN documentation for a reference on the <httpHandlers> element. The verb attribute must be set to “*” for the handlers. Website files A handler can be added to a website as an .ashx file. Example of how to add sign on handler in a file called signon.ashx: <%@ WebHandler %> More examples of .ashx files can be found in the website demo in the distribution. 10.3 Attribute queries An attribute query enables a service provider to request more attributes on an authenticated subject from the federation partner that authenticated him. More information on attribute queries can be found in section 3.3.2.3 of [SAML]. The queries are executed with the currently authenticated user as a subject. Returned attributes are available through the Saml20Identity class after the query finishes.