title: How should I implement SAMLP 2.0 in an ASP.NET MVC 4 service provider?
body: <p>I'm developing an MVC 4 web application in C# and want to handle login using an existing SAML 2.0 identity provider. I am using <a href="http://en.wikipedia.org/wiki/SAML_2.0#HTTP_POST_Binding" rel="noreferrer">HTTP POST binding</a> with <a href="http://simplesamlphp.org/" rel="noreferrer">SimpleSAMLphp</a>.</p>
  
  <p>It seems like, in .NET 4.5, I should be using <strong><a href="http://msdn.microsoft.com/en-us/library/hh377151.aspx" rel="noreferrer">Windows Identity Foundation</a></strong>. First, I tried to install the <a href="http://msdn.microsoft.com/en-us/library/hh545418(v=vs.110).aspx" rel="noreferrer">Identity and Access Tool</a>. (I am using Visual Studio 2013, which is supposed to have this tool integrated, but VS2013's version <a href="http://bartwullems.blogspot.com.au/2013/11/visual-studio-2013-where-is-identity.html" rel="noreferrer">doesn't support "re-entrancy"</a>, meaning I can't use it to add WIF support to my existing application.)</p>
  
  <p>After pointing the Identity and Access Tool to my identity provider's metadata, I get this error message:</p>
  
  <p><img src="https://i.stack.imgur.com/obnNF.png" alt="userSelection.SecurityTokenServiceMetadata.SecurityTokenServiceDescriptor"></p>
  
  <p>Apparently, this is the error message that indicates that <strong><a href="http://support.microsoft.com/kb/2884655" rel="noreferrer">SAMLP 2.0 is not supported by WIF</a></strong>. This seems to be distinct from SAML 2.0 <em>tokens</em>, which are supported (at least, this <a href="http://msdn.microsoft.com/en-us/library/microsoft.identitymodel.tokens.saml2.aspx" rel="noreferrer">outdated documentation</a> indicates that there was a <code>Microsoft.IdentityModel.Tokens.Saml2</code> namespace).</p>
  
  <p>I then discovered the <strong><a href="http://blogs.msdn.com/b/card/archive/2011/05/16/announcing-the-wif-extension-for-saml-2-0-protocol-community-technology-preview.aspx" rel="noreferrer">WIF Extension for SAML 2.0</a></strong>. However, this was released in May 2011 and doesn't seem to have been touched since then. Nonetheless, I downloaded the extension and attempted to build the SamlConfigTool included in the ZIP file. The tool is a console application which informs me that:</p>
  
  <blockquote>
    <p>This tool will prompt for information needed to create a metadata file that describes your relying party. It will prompt for the addresses of partner metadata files to be downloaded.  Finally, it will output a file called <code>Changes_To_Web_Config.xml</code> that has the changes that should be made to your web site's web.config file to enable SAML protection.</p>
  </blockquote>
  
  <p>After entering my entity ID and SAML endpoint, the SamlConfigTool promptly crashed. Okay, maybe I don't need to use the configuration tool and I can just copy what's done in the sample ServiceProvider VS project. After migration, I'm able to open the project in VS2012, but it's not clear to me exactly how it works — it doesn't seem to contain any C# code, just new entries in Web.config. It's not clear to me how I should adapt this configuration to replace the custom login code in my MVC 4 app, and in any case relying on a dead library from 3 years ago doesn't seem like a great idea.</p>
  
  <p>So, <strong>what is the best way to implement SAML 2.0 in ASP.NET MVC 4</strong>? I'm currently decoding, encoding, parsing and compressing XML by hand and it feels like there should be an easier way.</p>