title: Sustainsys: error: "IDX13102: Exception thrown while reading '[PII is hidden]' for Saml2SecurityToken. Inner exception: 'System.ArgumentException'."
body: <h2>Nuget Packages in use:</h2>
  
  <ol>
  <li>Microsoft.AspNetCore.App - 2.1.1</li>
  <li>Microsoft.NETCore.App - 2.1.0</li>
  <li>Sustainsys.Saml2.AspNetCore2 - 2.2.0</li>
  </ol>
  
  <p>Dotnet Core version: 2.1.302</p>
  
  <h2>Implementation</h2>
  
  <p>Following code is added in the startup.cs file in <code>ConfigureServices(IServiceCollection services)</code> method:</p>
  
  <pre><code>services.AddSaml2("saml2", options =&gt;
  {
      options.SPOptions.EntityId = new Sustainsys.Saml2.Metadata.EntityId(this.Configuration.Get&lt;AppSetting&gt;().SPEntityId);
      options.SPOptions.MinIncomingSigningAlgorithm = "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
      options.SPOptions.NameIdPolicy = new Sustainsys.Saml2.Saml2P.Saml2NameIdPolicy(true, Sustainsys.Saml2.Saml2P.NameIdFormat.Unspecified);
      options.IdentityProviders.Add(
              new Sustainsys.Saml2.IdentityProvider(
                  new Sustainsys.Saml2.Metadata.EntityId(this.Configuration.Get&lt;AppSetting&gt;().SPMetadata), options.SPOptions)
                  {
                      LoadMetadata = true,
                      Binding = Sustainsys.Saml2.WebSso.Saml2BindingType.HttpPost
                  });
  })
  </code></pre>
  
  <p>The authentication is triggered by following controller action:</p>
  
  <pre><code>[HttpGet]
  public IActionResult Login(string returnUrl = null)
  {
      var redirectUrl = Url.Content("~/Saml/Callback");
      return Challenge(
          new AuthenticationProperties { RedirectUri = redirectUrl }, "saml2");
  }
  </code></pre>
  
  <p>The authentication with the ID server is successfully done and response is received as POST request on <code>https://SP-Server-xxxx/server/Saml2/Acs</code> as per XML at the end of this post. However, then following error is returned with HTTP code 500:</p>
  
  <pre><code>{
      error: "IDX13102: Exception thrown while reading '[PII is hidden]' for Saml2SecurityToken. Inner exception: 'System.ArgumentException'."
  }
  </code></pre>
  
  <p>Please suggest what is wrong with the setup or the implementation.</p>
  
  <p>Response XML:</p>
  
  <pre><code>&lt;samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Consent="urn:oasis:names:tc:SAML:2.0:consent:obtained" Destination="https://SP-Server-xxxx/server/Saml2/Acs" ID="XXXXX" InResponseTo="XXXXX" IssueInstant="2018-11-28T06:26:12Z" Version="2.0"&gt;
      &lt;saml:Issuer&gt;https://ID-Server-yyyy/zzzz/saml2/metadata&lt;/saml:Issuer&gt;
      &lt;samlp:Status&gt;
          &lt;samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/&gt;
      &lt;/samlp:Status&gt;
      &lt;saml:Assertion ID="XXXXX" IssueInstant="2018-11-28T06:26:12Z" Version="2.0"&gt;
          &lt;saml:Issuer&gt;https://ID-Server-yyyy/zzzz/saml2/metadata&lt;/saml:Issuer&gt;
          &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;ds:SignedInfo&gt;
                  &lt;CanonicalizationMethod xmlns="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                  &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
                  &lt;ds:Reference URI="#yyyyy"&gt;
                      &lt;ds:Transforms&gt;
                          &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/&gt;
                          &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                      &lt;/ds:Transforms&gt;
                      &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
                      &lt;DigestValue xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;zzzzz&lt;/DigestValue&gt;
                  &lt;/ds:Reference&gt;
              &lt;/ds:SignedInfo&gt;
              &lt;SignatureValue xmlns="http://www.w3.org/2000/09/xmldsig#"&gt; 'removed the signature value' &lt;/SignatureValue&gt;
              &lt;ds:KeyInfo&gt;
                  &lt;ds:X509Data&gt;
                      &lt;ds:X509Certificate&gt; 'removed the certificate' &lt;/ds:X509Certificate&gt;
                  &lt;/ds:X509Data&gt;
              &lt;/ds:KeyInfo&gt;
          &lt;/ds:Signature&gt;
          &lt;saml:Subject&gt;
              &lt;saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" NameQualifier="https://ID-Server-yyyy/zzzz/saml2/metadata" SPNameQualifier="https://SP-Server-xxxx"&gt;
                  abc@xyz.com
              &lt;/saml:NameID&gt;
              &lt;saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"&gt;
                  &lt;saml:SubjectConfirmationData InResponseTo="XXXXX" NotOnOrAfter="2018-11-28T06:31:12Z" Recipient="https://SP-Server-xxxx/server/Saml2/Acs"/&gt;
              &lt;/saml:SubjectConfirmation&gt;
          &lt;/saml:Subject&gt;
          &lt;saml:Conditions NotBefore="2018-11-28T06:21:12Z" NotOnOrAfter="2018-11-28T06:31:12Z"&gt;
              &lt;saml:AudienceRestriction&gt;
                  &lt;saml:Audience&gt;https://SP-Server-xxxx&lt;/saml:Audience&gt;
              &lt;/saml:AudienceRestriction&gt;
          &lt;/saml:Conditions&gt;
          &lt;saml:AuthnStatement AuthnInstant="2018-11-28T06:26:09Z" SessionIndex="XXXXX"&gt;
              &lt;saml:AuthnContext&gt;
                  &lt;saml:AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:Password&lt;/saml:AuthnContextClassRef&gt;
                  &lt;saml:AuthnContextDeclRef&gt;name/password/uri&lt;/saml:AuthnContextDeclRef&gt;
              &lt;/saml:AuthnContext&gt;
          &lt;/saml:AuthnStatement&gt;
          &lt;saml:AttributeStatement&gt;
              &lt;saml:Attribute xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Name="LastName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"&gt;
                  &lt;saml:AttributeValue xsi:type="xs:string"&gt;Last Name&lt;/saml:AttributeValue&gt;
              &lt;/saml:Attribute&gt;
              &lt;saml:Attribute xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Name="mail" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"&gt;
                  &lt;saml:AttributeValue xsi:type="xs:string"&gt;abc@xyz.com&lt;/saml:AttributeValue&gt;
              &lt;/saml:Attribute&gt;
              &lt;saml:Attribute xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Name="MiddleName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"&gt;
                  &lt;saml:AttributeValue xsi:type="xs:string"&gt;Middle Name&lt;/saml:AttributeValue&gt;
              &lt;/saml:Attribute&gt;
              &lt;saml:Attribute xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Name="FirstName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"&gt;
                  &lt;saml:AttributeValue xsi:type="xs:string"&gt;First Name&lt;/saml:AttributeValue&gt;
              &lt;/saml:Attribute&gt;
              &lt;saml:Attribute xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Name="Id" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"&gt;
                  &lt;saml:AttributeValue xsi:type="xs:string"&gt;Id Value&lt;/saml:AttributeValue&gt;
              &lt;/saml:Attribute&gt;
          &lt;/saml:AttributeStatement&gt;
      &lt;/saml:Assertion&gt;
  &lt;/samlp:Response&gt;
  </code></pre>
  
  <p><strong>UPDATE:</strong>
  After setting <code>IdentityModelEventSource.ShowPII</code> to true the error response is changed as followed:</p>
  
  <pre><code>{
      error: "IDX13102: Exception thrown while reading 'AuthnContext' for Saml2SecurityToken. Inner exception: 'System.ArgumentException: IDX13300: 'value' must be an absolute Uri, was: 'name/password/uri' at Microsoft.IdentityModel.Tokens.Saml2.Saml2AuthenticationContext.set_DeclarationReference(Uri value) at Microsoft.IdentityModel.Tokens.Saml2.Saml2AuthenticationContext..ctor(Uri classReference, Uri declarationReference) at Microsoft.IdentityModel.Tokens.Saml2.Saml2Serializer.ReadAuthenticationContext(XmlDictionaryReader reader)'."
  }
  </code></pre>
  
  <p>Based on the error message I assume the ID server needs to set the AuthnContext with a valid URI. Please confirm.</p>
  
  <p>Following is the Stack-Trace:</p>
  
  <pre><code>2018-11-29 08:45:10.700 +01:00 [Debug] Signature validation passed for Saml Response Microsoft.IdentityModel.Tokens.Saml2.Saml2Id
  2018-11-29 08:45:10.759 +01:00 [Error] Exception is occurred
  Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityTokenReadException: IDX13102: Exception thrown while reading 'AuthnContext' for Saml2SecurityToken. Inner exception: 'System.ArgumentException: IDX13300: 'value' must be an absolute Uri, was: 'name/password/uri'
     at Microsoft.IdentityModel.Tokens.Saml2.Saml2AuthenticationContext.set_DeclarationReference(Uri value)
     at Microsoft.IdentityModel.Tokens.Saml2.Saml2AuthenticationContext..ctor(Uri classReference, Uri declarationReference)
     at Microsoft.IdentityModel.Tokens.Saml2.Saml2Serializer.ReadAuthenticationContext(XmlDictionaryReader reader)'. ---&gt; System.ArgumentException: IDX13300: 'value' must be an absolute Uri, was: 'name/password/uri'
     at Microsoft.IdentityModel.Tokens.Saml2.Saml2AuthenticationContext.set_DeclarationReference(Uri value)
     at Microsoft.IdentityModel.Tokens.Saml2.Saml2AuthenticationContext..ctor(Uri classReference, Uri declarationReference)
     at Microsoft.IdentityModel.Tokens.Saml2.Saml2Serializer.ReadAuthenticationContext(XmlDictionaryReader reader)
     --- End of inner exception stack trace ---
     at Microsoft.IdentityModel.Tokens.Saml2.Saml2Serializer.ReadAuthenticationContext(XmlDictionaryReader reader)
     at Microsoft.IdentityModel.Tokens.Saml2.Saml2Serializer.ReadAuthenticationStatement(XmlDictionaryReader reader)
     at Sustainsys.Saml2.Saml2P.Saml2PSerializer.ReadAssertion(XmlReader reader)
     at Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityTokenHandler.ReadSaml2Token(String token)
     at Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken&amp; validatedToken)
     at Sustainsys.Saml2.Saml2P.Saml2Response.CreateClaims(IOptions options, IdentityProvider idp)+MoveNext()
     at System.Collections.Generic.List`1.AddEnumerable(IEnumerable`1 enumerable)
     at System.Linq.Enumerable.ToList[TSource](IEnumerable`1 source)
     at Sustainsys.Saml2.Saml2P.Saml2Response.GetClaims(IOptions options, IDictionary`2 relayData)
     at Sustainsys.Saml2.WebSso.AcsCommand.ProcessResponse(IOptions options, Saml2Response samlResponse, StoredRequestState storedRequestState)
     at Sustainsys.Saml2.WebSso.AcsCommand.Run(HttpRequestData request, IOptions options)
     at Sustainsys.Saml2.AspNetCore2.Saml2Handler.HandleRequestAsync()
     at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
     at Service.Provider.Middleware.LanguageHandlingMiddleware.Invoke(HttpContext context) in X:\Projects\Service-Provider\Middleware\LanguageHandlingMiddleware.cs:line 21
     at Service.Provider.Middleware.ErrorHandlingMiddleware.Invoke(HttpContext context, ILogger`1 logger) in X:\Projects\Service-Provider\Middleware\ErrorHandlingMiddleware.cs:line 22
  </code></pre>
  
  <p><strong>Update 2</strong></p>
  
  <p>Thanks for the response @Anders. As we dont have control over the ipd, I have requested the idp developers to consider above change.
  But meanwhile we have tried to dig further into the options. I have referred one the documents hosted here: <a href="https://media.readthedocs.org/pdf/saml2/latest/saml2.pdf" rel="nofollow noreferrer">https://media.readthedocs.org/pdf/saml2/latest/saml2.pdf</a>. The section 2.18.1 lists the attributes of  Element. It mentions about <code>IgnoreAuthenticationContextInResponse</code> attribute. Based on the description of the attribute, it seems that making this as <code>true</code> will solve the above error.
  But I cannot find this attribute while configuring the Compatibility element in SPOtions (<code>options.SPOptions.Compatibility.IgnoreAuthenticationContextInResponse</code> ?)</p>
  
  <p>We are using Sustainsys.Saml2.AspNetCore2 package version 2.2.0.</p>
  
  <p>Is it so that the <code>Compatibility.IgnoreAuthenticationContextInResponse</code> attribute is not yet available in version 2.2.0 ?</p>