Signature validation of message with the " " character sequence
bdhamelicodra opened this issue · 4 comments
When acting as Service Provider and using PingOne Identity Provider with both assertion and response signature, PingOne adds the certificate used to sign the assertion in the response, this certificate contains the sequence of characters " ".
The .Net Framework classes System.Security.Cryptography.Xml.SignedXml and System.Xml.XmlDocument, seem to remove the character sequence " " when reading the XML document of the response and failed to verify signature of the message (no problem with the assertion signature).
The signing certificate is provided by PingOne with no configuration options (in particular, removing this character sequence or not including the certificate in the response).
The problem only occurs if the option Sign Assertion & Response is selected in PingOne.
The signature validation works if either the option Sign Assertion or Sign Response is selected.
Options in PingOne:
Maybe related problem
https://stackoverflow.com/questions/71446457/aws-sso-signature-verification-problems
The problem shown in a diff
On the right, XML received from PingOne
On the left, after the XML is passed by .NET
Eexpect the problem to be solved in .NET 7.