Error on property NameIDPolicy.AllowCreate when parsing legitimate SAML Request coming from Shibboleth - itfoxtec-identity-saml2

Question

I am implementing a SingleSignOn solution (IdP) based on your software and having a little problem when receiving a SAMLRequest (http redirect), generated by Shibboleth.
This request contains an element: <samlp:NameIDPolicy AllowCreate="1"/>
The SAML2 standard (https://www.oasis-open.org/committees/download.php/35711/sstc-saml-core-errata-2.0-wd-06-diff.pdf lines 2186 an later) states that this is a boolean attribute.
The SAML standard is only talking about the possible values "true" and "false"
But the xml standard https://www.w3.org/TR/xmlschema11-2/#boolean (on which SAML2 standard is based) specifies: booleanRep ::= 'true' | 'false' | '1' | '0'
So the element sent by Shibboleth should be correct.
But when parsing the SAML request I get a error message:
System.FormatException: String '1' was not recognized as a valid Boolean.
I examined the sources in github
In the ITfoxtec project this NamedIdPolicy is defined in https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2/blob/662544c8e08c46bf1736bd72fcf31d06aeac1d9d/src/ITfoxtec.Identity.Saml2/Schemas/NameIDPolicy.cs
And the parsing is done in https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2/blob/662544c8e08c46bf1736bd72fcf31d06aeac1d9d/src/ITfoxtec.Identity.Saml2/Util/GenericTypeConverter.cs
The error message was generated by line 121: return (T)Convert.ChangeType(value, typeof(T));
I recreated the error message with this code snippet in LinqPad:
bool? AllowCreate = GenericConvertValueToNullable<bool>("true");
AllowCreate.Dump(); // returns boolean value true
AllowCreate = GenericConvertValueToNullable<bool>("1"); // Triggers error in Convert.ChangeType call
AllowCreate.Dump();
T? GenericConvertValueToNullable<T>(string value) where T : struct
{
if (string.IsNullOrWhiteSpace(value))
{
return null;
}
else
{
return (T)Convert.ChangeType(value, typeof(T));
}
}
The error occurs when converting the "1" value to boolean
I also found a possible solution
Insert these lines before the Convert.ChangeType line:
if(typeof(T) == typeof(bool))
{
int intValue;
if(int.TryParse(value, out intValue))
{
if (intValue == 0 || intValue == 1)
{
return (T)Convert.ChangeType(intValue, typeof(bool));
}
}
}
In the result code, 'true' | 'false' | '1' | '0' can all be used as valid values
I tested that "7", "-1", "x" still cause the error message, as they are not valid accoording to xml standard, so thats also correct.
Is it possible that you make these changes, and release a new version of the NuGet package?
Maybe there are more boolean attributes that need complying to the xml standard?

Answer 1

The link https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2/blob/662544c8e08c46bf1736bd72fcf31d06aeac1d9d/src/ITfoxtec.Identity.Saml2/Schemas/NameIDPolicy.cs is to a working Draft.
The SAML 2.0 core standard from 2005:
https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf where NameIDPolicy.AllowCreate is described in chapter 3.4.1.1.
I don't think AllowCreate can be anything else then true and false according to the SAML 2.0 core standard.
1) UPDATE
It is possible to add support for not strictly SAML 2.0 Authn request and thereby accept NameIdPolicy.AllowCreate non SAML 2.0 standard values.
You can implement your own version of the Saml2AuthnRequest class inherited from Saml2Request class.
Where you change the NameIdPolicy to your own NameIdPolicy implementation.
public MyCustomNameIdPolicy NameIdPolicy { get; set; }
The MyCustomNameIdPolicy is implemented based on the NameIdPolicy code, where the AllowCreate property type is changed to a string.
public string AllowCreate { get; set; }
The AllowCreate will then accept both true, false, 1 and 0 as strings.
2) UPDATE
The reason for the problem you describe is probably because you need to implement MyCustomNameIdPolicy in GetXContent line 144 and Read line 169.