title: Signing a SAML response generates CryptographicException: An XmlDocument context is required for enveloped transforms
body: <p>I am trying to sign the following SAML assertion using System.Security.Xml.</p>
  
  <pre><code>&lt;saml:Assertion xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" mlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" ID="pfx96e500ef-d656-e97c-17ee-bbeff75c7235" Version="2.0" IssueInstant="2014-07-17T01:01:48Z"&gt;
    &lt;saml:Issuer&gt;http://idp.example.com/metadata.php&lt;/saml:Issuer&gt;
    &lt;saml:Subject&gt;
      &lt;saml:NameID SPNameQualifier="http://sp.example.com/demo1/metadata.php" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"&gt;_ce3d2948b4cf20146dee0a0b3dd6f69b6cf86f62d7&lt;/saml:NameID&gt;
      &lt;saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"&gt;
        &lt;saml:SubjectConfirmationData NotOnOrAfter="2024-01-18T06:21:48Z" Recipient="http://sp.example.com/demo1/index.php?acs" InResponseTo="ONELOGIN_4fee3b046395c4e751011e97f8900b5273d56685"/&gt;
      &lt;/saml:SubjectConfirmation&gt;
    &lt;/saml:Subject&gt;
    &lt;saml:Conditions NotBefore="2014-07-17T01:01:18Z" NotOnOrAfter="2024-01-18T06:21:48Z"&gt;
      &lt;saml:AudienceRestriction&gt;
        &lt;saml:Audience&gt;http://sp.example.com/demo1/metadata.php&lt;/saml:Audience&gt;
      &lt;/saml:AudienceRestriction&gt;
    &lt;/saml:Conditions&gt;
    &lt;saml:AuthnStatement AuthnInstant="2014-07-17T01:01:48Z" SessionNotOnOrAfter="2024-07-17T09:01:48Z" SessionIndex="_be9967abd904ddcae3c0eb4189adbe3f71e327cf93"&gt;
      &lt;saml:AuthnContext&gt;
        &lt;saml:AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:Password&lt;/saml:AuthnContextClassRef&gt;
      &lt;/saml:AuthnContext&gt;
    &lt;/saml:AuthnStatement&gt;
    &lt;saml:AttributeStatement&gt;
      &lt;saml:Attribute Name="uid" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"&gt;
        &lt;saml:AttributeValue xsi:type="xs:string"&gt;test&lt;/saml:AttributeValue&gt;
      &lt;/saml:Attribute&gt;
      &lt;saml:Attribute Name="mail" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"&gt;
        &lt;saml:AttributeValue xsi:type="xs:string"&gt;test@example.com&lt;/saml:AttributeValue&gt;
      &lt;/saml:Attribute&gt;
      &lt;saml:Attribute Name="eduPersonAffiliation" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"&gt;
        &lt;saml:AttributeValue xsi:type="xs:string"&gt;users&lt;/saml:AttributeValue&gt;
        &lt;saml:AttributeValue xsi:type="xs:string"&gt;examplerole1&lt;/saml:AttributeValue&gt;
      &lt;/saml:Attribute&gt;
    &lt;/saml:AttributeStatement&gt;
  &lt;/saml:Assertion&gt;
  </code></pre>
  
  <p>And the following code:</p>
  
  <pre><code>    [TestMethod]
      public void SignAssertion()
      {
          var xmlDoc = new XmlDocument { PreserveWhitespace = true };
          xmlDoc.Load("UnsignedAssertion.xml");
          var certStore = new X509Store("MY", StoreLocation.CurrentUser);
          certStore.Open(OpenFlags.ReadOnly);
          X509Certificate2Collection certs;
          try
          {
              certs = certStore.Certificates.Find(X509FindType.FindBySubjectName, "AValidCertificate", true);
          }
          finally
          {
              certStore.Close();
          }
          var cert = certs[0];
          var signedXml = new SignedXml(xmlDoc);
          var transforms = new TransformChain();
          transforms.Add(new XmlDsigEnvelopedSignatureTransform());
          transforms.Add(new XmlDsigExcC14NTransform());
          var reference = new Reference
          {
              Id = "#pfx96e500ef-d656-e97c-17ee-bbeff75c7235",
              TransformChain = transforms
          };
          signedXml.AddReference(reference);
          signedXml.SigningKey = cert.PrivateKey;
          signedXml.ComputeSignature();
      }
  </code></pre>
  
  <p>Calling ComputeSignature fails with the following error:</p>
  
  <blockquote>
    <p>Message: Test method SamlPoc.UnitTest1.SignAssertion threw exception: 
    System.Security.Cryptography.CryptographicException: An XmlDocument
    context is required for enveloped transforms.</p>
  </blockquote>
  
  <p>And the following stack trace:</p>
  
  <pre><code>at System.Security.Cryptography.Xml.XmlDsigEnvelopedSignatureTransform.GetOutput() 
  at System.Security.Cryptography.Xml.TransformChain.TransformToOctetStream(Object inputObject, Type inputType, XmlResolver resolver, String baseUri)   
  at System.Security.Cryptography.Xml.TransformChain.TransformToOctetStream(Stream input, XmlResolver resolver, String baseUri)    
  at System.Security.Cryptography.Xml.Reference.CalculateHashValue(XmlDocument document, CanonicalXmlNodeList refList)    
  at System.Security.Cryptography.Xml.SignedXml.BuildDigestedReferences()   
  at System.Security.Cryptography.Xml.SignedXml.ComputeSignature()
  </code></pre>
  
  <p>It seems to me like I passed a valid XmlDocument to the SignedXml, which should be considered a valid XMLDocument context. What am I missing?</p>