SSO SAML数字签名验证-XML Unicode字符

Question

I have a web based application where SSO using SAML(as a service provider) is implemented. It involves Digital Signature verification. Everything works fine with following code if there is no unicode character like 'ü' in the XML response being post to system.

But with UNICODE character it throws exception while loading xml into XMLDocument class. If i save the XML response in a notepad file using Unicode format and read the same for digital signature verification, things are working fine. I need to have alternative of notepad manual steps in C# implementation.

Following is the code i am using.

if (m_b64SamlResponse == null || m_b64SamlResponse == string.Empty)
return "SAMLResponse null or empty";
string xml = Decode(m_b64SamlResponse);

m_xmlDoc = new XmlDocument();
m_xmlDoc.PreserveWhitespace = true;

m_xmlDoc.LoadXml(xml);

XmlNamespaceManager nsm = new XmlNamespaceManager(new NameTable());
nsm.AddNamespace("dsig", SignedXml.XmlDsigNamespaceUrl);
XmlElement sigElt = (XmlElement)xd.SelectSingleNode(
"//dsig:Signature", nsm);
// Load the signature for verification
SignedXml sig = new SignedXml(m_xmlDoc);
sig.LoadXml(sigElt);
if (!sig.CheckSignature())
return "Invalid Signature";
else
return "Valid Signature";

Answer 1

This may be caused by the fact that SAML documents often don't contain the classic xml header <?xml version="1.0" encoding="utf-8"?>

Did you try to force the encoding to UTF-8 ?

You could try something similar to this example:

string xml = Decode(m_b64SamlResponse);

byte[] xmlUTF8 = Encoding.UTF8.GetBytes(xml);

MemoryStream ms = new MemoryStream(encodedString);
ms.Flush();
ms.Position = 0;

m_xmlDoc = new XmlDocument();
m_xmlDoc.PreserveWhitespace = true;

m_xmlDoc.Load(ms);