Why is this SAML 2.0 AuthnRequest invalid?

Question

I have C# code to produce a SAML 2.0 AuthnRequest:

String requestXML = "<samlp:AuthnRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"https://saml.example.com/login\" Version=\"2.0\" IssueInstant=\"" + DateTime.Now.ToString("yyyy-MM-ddTHH:mm:ss") + "\" AssertionConsumerServiceIndex=\"0\"><saml:Issuer>https://saml.example.com/login</saml:Issuer><samlp:NameIDPolicy AllowCreate=\"true\" Format=\"urn:oasis:names:tc:SAML:2.0:nameid-format:transient\"/></samlp:AuthnRequest>";
String convertedRequestXML = System.Convert.ToBase64String(System.Text.ASCIIEncoding.ASCII.GetBytes(requestXML));
return Redirect("https://idp.ssocircle.com:443/sso/SSORedirect/metaAlias/ssocircle"+ "?SAMLRequest=" + convertedRequestXML + "&RelayState=" + HttpUtility.UrlEncode("/SamlLogin?ReturnUrl=" + returnurl));

With my actual domain name instead of example.com. I set this up on https://ssocircle.com/ with the SP metadata like this

<md:EntityDescriptor
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
entityID="https://saml.example.com/login">
<md:SPSSODescriptor
    protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <md:AssertionConsumerService index="0"
        Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
        Location="https://saml.example.com/login" />
</md:SPSSODescriptor>
<md:Organization>
    <md:OrganizationName xml:lang="en">
        example
    </md:OrganizationName>
    <md:OrganizationDisplayName xml:lang="en">
        example
    </md:OrganizationDisplayName>
    <md:OrganizationURL xml:lang="en">
        http://www.example.com/
    </md:OrganizationURL>
</md:Organization>

However, the page returns with:

Error occurred
Reason: The SAML Request is invalid. 

And unhelpfully, no other errors. I have also tried setting this up with https://openidp.feide.no but that only returned a blank page with a 500 server error.

My get string comes out as

https://idp.ssocircle.com/sso/SSORedirect/metaAlias/ssocircle?SAMLRequest=PHNhbWxwOkF1dGhuUmVxdWVzdCB4bWxuczpzYW1scD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiB4bWxuczpzYW1sPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIiBJRD0iaHR0cHM6Ly9zYW1sLmV4YW1wbGUuY29tL2xvZ2luIiBWZXJzaW9uPSIyLjAiIElzc3VlSW5zdGFudD0iMjAxNC0wOS0xMVQwOTozMTo1NyIgQXNzZXJ0aW9uQ29uc3VtZXJTZXJ2aWNlSW5kZXg9IjAiPjxzYW1sOklzc3Vlcj5odHRwczovL3NhbWwuZXhhbXBsZS5jb20vbG9naW48L3NhbWw6SXNzdWVyPjxzYW1scDpOYW1lSURQb2xpY3kgQWxsb3dDcmVhdGU9InRydWUiIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOm5hbWVpZC1mb3JtYXQ6dHJhbnNpZW50Ii8+PC9zYW1scDpBdXRoblJlcXVlc3Q+&RelayState=%2fSamlLogin%3fReturnUrl%3d31lOpEvtWshJNDa314yOgw%3d%3d

Which https://idp.ssocircle.com/sso/toolbox/samlDecode.jsp is 'unable to decode' and https://rnd.feide.no/simplesaml/module.php/saml2debug/debug.php comes out with

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="https://saml.example.com/login" Version="2.0" IssueInstant="2014-09-11T09:31:57" AssertionConsumerServiceIndex="0"><saml:Issuer>https://saml.example.com/login</saml:Issuer><samlp:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/��[[�]]��\]Y\�

I have also tried with similar results

String convertedRequestXML = System.Convert.ToBase64String(System.Text.UTF8Encoding.UTF8.GetBytes(requestXML));

My questions are 1) Is my SAML AuthnRequest actually valid? 2) Is my encoding method correct? 3) Are there any better tools I can use to debug this? These sites do not give out any helpful (or any at all) error messages when something goes wrong

Answer 1

It's not enough to Base64 encode the request, you also need to do something called deflating. Read the chapter on the HTTP redirect binding .

There is a explanation on how to defalte in C# here