title: SAML 2.0 C# - Issues verifying SAML Response
body: <p>I was able to successfully develop and use an IdP to generate a SAMLResponse to pass authentication to third party applications. However, now I need to create a service provider to generate a SAMLRequest and consume a SAMLResponse.</p>
  
  <p>The SAMLRequest part went smoothly, I'm able to make a call to the IdP passing a SAMLRequest, and once authentication is successful the IdP sends me a SAMLResponse back. The part I'm having problems is <strong>verifying the signature on the SAMLResponse using a X509Certificate2</strong>.</p>
  
  <p>After extensive googling and following other people successf, here's the closest I got to making it work:</p>
  
  <p><strong>SamlSignedXml class</strong></p>
  
  <pre><code>public class SamlSignedXml : SignedXml
  {
      private string _referenceAttributeId = "";
      public SamlSignedXml(XmlElement element, string referenceAttributeId)
          : base(element)
      {
          _referenceAttributeId = referenceAttributeId;
      }
      public override XmlElement GetIdElement(XmlDocument document, string idValue)
      {
          return (XmlElement)document.SelectSingleNode(string.Format("//*[@{0}='{1}']", _referenceAttributeId, idValue));
      }
  }
  </code></pre>
  
  <p><strong>Code</strong></p>
  
  <pre><code>String decodedSaml = SAMLResponse;
  XmlDocument xmlDoc = new XmlDocument();
  xmlDoc.PreserveWhitespace = true;
  xmlDoc.Load(new StringReader(decodedSaml));
  XmlNamespaceManager nSpace = new XmlNamespaceManager(xmlDoc.NameTable);
  nSpace.AddNamespace("ds", SignedXml.XmlDsigNamespaceUrl);
  XmlNodeList nodeList = xmlDoc.GetElementsByTagName("ds:Signature");
  XmlElement signNode = (XmlElement)nodeList[0];
  SamlSignedXml samlSignedXml = new SamlSignedXml((XmlElement)xmlDoc.DocumentElement, "ResponseID");
  samlSignedXml.LoadXml((XmlElement)signNode);
  X509Certificate2 certificate = new X509Certificate2("C:\\cert.crt");
  bool samlValid = samlSignedXml.CheckSignature(certificate, true);
  </code></pre>
  
  <p><strong>SAMLReponse</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;Response xmlns="urn:oasis:names:tc:SAML:2.0:protocol" IssueInstant="2015-11-24T15:57:26" ID="_388afdb8-1875-4c9f-a57b-d69983ad8489" Version="2.0"&gt;
     &lt;Status&gt;
        &lt;StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /&gt;
     &lt;/Status&gt;
     &lt;Assertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion" ID="_c9cb5535-6350-4027-8357-bb39f5128564" IssueInstant="2015-11-24T15:57:26.395Z" Version="2.0"&gt;
        &lt;Issuer&gt;https://issuerwebsite.com&lt;/Issuer&gt;
        &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
           &lt;ds:SignedInfo&gt;
              &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /&gt;
              &lt;ds:Reference URI="#_c9cb5535-6350-4027-8357-bb39f5128564"&gt;
                 &lt;ds:Transforms&gt;
                    &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /&gt;
                    &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                 &lt;/ds:Transforms&gt;
                 &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                 &lt;ds:DigestValue&gt;78xPMN/sD1QCbzf/h4VMkEHeOVY=&lt;/ds:DigestValue&gt;
              &lt;/ds:Reference&gt;
           &lt;/ds:SignedInfo&gt;
           &lt;ds:SignatureValue&gt;tCyN+6vQP70TRyvZKtM788f90tqVGaQDXO1OotxXi7CRMBiFcQ1xZO4CERCV13dY4EfMy4GAZ27PARNTMwjyyp6SdlvDFffJwNOUydWM3jA9ab3xfp2U7eNWPBp7/fF6caAukl+O9H7Ou91bZVgHlEMfULhy8z2OlDcEeT6KiM2MGLRErfIy1YNeRcoKEtQABVwQYGppgNQcT1IZU0Z+8sF+NBUCiTuby2KUu5+S+M0guYP0encWEQsw2MaXXfiVGOpiZiPkEC01qTcFPu3z86sgc4nOtVlGqTlYMdpV/KWZGvmTc/n7m4rNZYEe3RwMzdBKtUwnyrnHOwf8hMP2cH7R2KDqmysUcq6Xz/mt5JwP7xeV599l8anSFPRME1SiST+VsHDn5hdgjvlqc2TY+baEYWBli8g+cwFrf4+u2X37DIaTBR+7njAfEEXF5EK3jM+hNdBVeaOJr4Ox4ic5FHOLRs7lU2AhbC12g4aZF3rKQRVGaQWgqVuwqJRu6APR3Yi7DwOjPDpiyRl4ZUTci/5EP10vR6D6MJ/ryIS1cz2iTfp6a/C8rc08e2gO+khlhRQ92hdeNV3BD9kaauafjgR5YM9GEkKpn8pQS0qzYKEkqrmMLUBYmxPgbFG4JFLRbhrwembi6UgpHYZs30wgRJ75+XGnsMoUYlIPSiNs6ak=&lt;/ds:SignatureValue&gt;
           &lt;KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;X509Data&gt;
                 &lt;X509Certificate&gt;XXXXXXXXXXXXXXXXXX&lt;/X509Certificate&gt;
              &lt;/X509Data&gt;
           &lt;/KeyInfo&gt;
        &lt;/ds:Signature&gt;
        &lt;Subject&gt;
           &lt;NameID&gt;P000037183&lt;/NameID&gt;
           &lt;SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer" /&gt;
           &lt;SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"&gt;
              &lt;SubjectConfirmationData InResponseTo="somethinghere" NotOnOrAfter="2015-11-24T15:57:56.395Z" Recipient="http://localhost:62255/Auth.aspx" /&gt;
           &lt;/SubjectConfirmation&gt;
        &lt;/Subject&gt;
        &lt;Conditions NotBefore="2015-11-24T15:57:26.395Z" NotOnOrAfter="2015-11-24T15:58:26.395Z"&gt;
           &lt;AudienceRestriction&gt;
              &lt;Audience&gt;http://localhost:62255/Auth.aspx&lt;/Audience&gt;
           &lt;/AudienceRestriction&gt;
        &lt;/Conditions&gt;
        &lt;AttributeStatement&gt;
           &lt;Attribute Name="xxid"&gt;
              &lt;AttributeValue&gt;1234&lt;/AttributeValue&gt;
           &lt;/Attribute&gt;
           &lt;Attribute Name="firstName"&gt;
              &lt;AttributeValue&gt;Rafa&lt;/AttributeValue&gt;
           &lt;/Attribute&gt;
           &lt;Attribute Name="lastName"&gt;
              &lt;AttributeValue&gt;Nadal&lt;/AttributeValue&gt;
           &lt;/Attribute&gt;
           &lt;Attribute Name="emailAddress"&gt;
              &lt;AttributeValue&gt;rafa@atp.com&lt;/AttributeValue&gt;
           &lt;/Attribute&gt;
        &lt;/AttributeStatement&gt;
        &lt;AuthnStatement AuthnInstant="2015-11-24T15:57:26.395Z"&gt;
           &lt;AuthnContext&gt;
              &lt;AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:Password&lt;/AuthnContextClassRef&gt;
           &lt;/AuthnContext&gt;
        &lt;/AuthnStatement&gt;
     &lt;/Assertion&gt;
  &lt;/Response&gt;
  </code></pre>
  
  <p>So, if I run it like this, I get the following error when calling CheckSignature:</p>
  
  <blockquote>
    <p>Malformed reference element</p>
  </blockquote>
  
  <p>I tried to change ResponseID to just ID (since that's what's actually in the response XML) and I get no errors, however, CheckSignature returns nothing, no exceptions, no true or false, the function returns when the method is called.</p>
  
  <p>Well, this the best I could come up with using the examples I found, so if you know a better way of validating the response I can't wait to hear it!</p>
  
  <p>Thanks a lot.</p>