SAML AuthnQuery and AuthnStatement

Internal

• SAML Concepts - Authentication Assertion

Example

AuthnQuery

<samlp:AuthnQuery xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"   
                  xmlns:ds="http://www.w3.org/2000/09/xmldsig#" 
                  xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" 
                  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
                  xsi:schemaLocation="urn:oasis:names:tc:SAML:2.0:protocol” ﾉ>

  <saml:Subject>

    <saml:SubjectConfirmation 
            Method="http://www.oasis-open.org/committees/security/docs/draft-sstc-core-25/password">

      <saml:SubjectConfirmationData> 
         cGFzc3dvcmQ=
      <saml:SubjectConfirmationData/>

    </saml:SubjectConfirmation>

  </saml:Subject>

  <samlp:RequestedAuthnContext Comparison="exact">

    <saml:AuthnContextClassRef>
      http://www.coresecuritypatterns.com
    </saml:AuthnContextClassRef>

  </samlp:RequestedAuthnContext>

</samlp:AuthnQuery>

AuthnStatement

<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" 
                xmlns:ds="http://www.w3.org/2000/09/xmldsig#" 
                xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" 
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
                IssueInstant="2005-06-01T09:30:47.0Z" 
                Version="2.0" 
                InResponseTo="NCName" 
                Destination="http://www.example.com" 
                ID="ID000065">

        ...

  <samlp:Status>

    <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>

    <samlp:StatusMessage>status is successful</samlp:StatusMessage>

  </samlp:Status>

  <saml:Assertion IssueInstant="2005-06-01T09:30:47.0Z" 
                  Version="2.0" 
                  ID="ID000072">

    <saml:Issuer NameQualifier="String" Format="http://www.coresecuritypatterns.com" 
                 SPProvidedID="MyServiceProvider" 
                 SPNameQualifier="String">
          Example
    </saml:Issuer>

    <saml:Subject>

      <saml:SubjectConfirmation 
          Method="http://www.oasis-open.org/committees/security/docs/draft-sstc-core-25/password">

         <saml:NameID NameQualifier="card:SQLDatabase">
             SomeName
         </saml:NameID>

         <saml:SubjectConfirmationData 
             NotBefore="2005-06-01T09:30:47.0Z" 
             InResponseTo="NCName" 
             Recipient="http://example.com" 
             NotOnOrAfter="2005-06-01T09:30:47.0Z" 
             Address="String"/>

      </saml:SubjectConfirmation>

    </saml:Subject>

    <saml:Conditions 
        NotBefore="2005-06-01T09:30:47.0Z" 
        NotOnOrAfter="2005-06-01T09:30:47.0Z">

          <saml:Condition xsi:type="a type derived from ConditionAbstractType"/>

    </saml:Conditions>

    <saml:Advice>

      <saml:AssertionIDRef>NCName</saml:AssertionIDRef>

    </saml:Advice>

    <saml:AuthnStatement
          AuthnInstant="2005-06-0131T12:00:00Z"
          SessionIndex="67775277772">

          <saml:AuthnContext>

            <saml:AuthnContextClassRef>
                 urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
             </saml:AuthnContextClassRef>

          </saml:AuthnContext>

      </saml:AuthnStatement>

   </saml:Assertion>

</samlp:Response>