NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
NuGet · #2729 most downloaded on NuGet
ASP.NET Core MVC integration helpers for implementing SAML 2.0 with ITfoxtec.Identity.Saml2. Adds SAML 2.0 service and middleware registration, request conversion, cookie authentication integration, and IActionResult helpers for SAML 2.0 login, logout, metadata, Redirect, POST, Artifact, and SOAP responses. Includes the core library's modern RSA/ECDSA signature validation and configurable assertion encryption support. The README explains when to implement SAML 2.0 directly in ASP.NET Core and when FoxIDs can act as an external SAML 2.0 bridge for applications that already support OpenID Connect or WS-Federation.
Last release 27 days ago
15 Sep 2026
Release timing varies
gaps range from 1 weeks to 9 months
Rarely documented
notes for 8 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
10 years old
90 releases · first in 2016
Updated System.Security.Cryptography.Xml to address security vulnerabilities, including CVE-2026-47304 and CVE-2026-50648 :
Updated System.Security.Cryptography.Xml to address security vulnerabilities, including CVE-2026-47304 and CVE-2026-50648:
10.0.12.9.0.20.8.0.4.Thanks to @elhaard for the dependency updates in #289. Fixes #286.
Updated Microsoft.IdentityModel.Tokens.Saml to 8.22.0 for .NET 6, 7, 8, 9, 10 and .NET Standard 2.1 to address CVE-2026-50653, a denial-of-service vulnerability in SAML parsing. Fixes #288 via #290.
Added EntitiesDescriptor.ToXElement() to generate group metadata as an XElement.
Thanks to @TobiasMarklund for the contribution in #287.
NuGet package released:
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2/
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2.Mvc/
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2.MvcCore/
One column per quarter.
Added package README files and README metadata to all three NuGet packages.
NuGet package released:
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2/
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2.Mvc/
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2.MvcCore/
Added expanded SAML response encryption support with configurable data encryption and key encryption algorithms. The library now supports additional X
Added expanded SAML response encryption support with configurable data encryption and key encryption algorithms. The library now supports additional XML Encryption algorithms, including AES-CBC, AES-GCM, RSA-OAEP, and XML Encryption 1.1 RSA-OAEP with SHA-256/MGF1-SHA256 support on supported .NET targets.
Encryption configuration now separates assertion encryption from key encryption, making it possible to align with IdPs and SAML components that expose separate EncryptionAlgorithm and KeyEncryptionAlgorithm settings. RSA-OAEP MGF parameters are also validated during decryption to provide clearer interoperability behavior.
NuGet package released:
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2/
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2.Mvc/
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2.MvcCore/
Added ECDSA signature support for modern .NET targets.
Added ECDSA signature support for modern .NET targets.
The SAML 2.0 component now supports ECDSA XML signatures and signature validation on .NET 10, .NET 9 and .NET 8. The following signature algorithms have been added:
ecdsa-sha256ecdsa-sha384ecdsa-sha512Existing signing configuration remains unchanged. ECDSA signing can be enabled by using an X509Certificate2 with an ECDSA key and setting SignatureAlgorithm to the relevant Saml2SecurityAlgorithms.Ecdsa*Signature value.
New optional validation allowlists have been added to Saml2Configuration:
SignatureValidationAlgorithmsXmlCanonicalizationValidationMethodsSignatureValidationAlgorithms is used only when validating incoming signatures with SignatureValidationCertificates. If the list is empty, validation falls back to SignatureAlgorithm.
XmlCanonicalizationValidationMethods is used only when validating signed XML canonicalization methods. If the list is empty, validation falls back to XmlCanonicalizationMethod.
During XML signature validation, the actual SignedInfo.SignatureMethod and SignedInfo.CanonicalizationMethod are read from the signature and must match the configured validation allowlists. This makes it possible to accept multiple incoming signature algorithms and canonicalization methods while continuing to generate outgoing signatures with SignatureAlgorithm and XmlCanonicalizationMethod.
ECDSA support applies only to signing and signature validation. It cannot be used for SAML encryption or decryption. RSA-based encryption and decryption behavior is unchanged.
NuGet package released:
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2/
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2.Mvc/
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2.MvcCore/
Nothing published for this version
Nothing published for this version
Add disposal of the RSA key in Saml2X509Certificate, enabling the RSA key to be disposed when disposing the certificate.
NuGet package released:
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2/
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2.Mvc/
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2.MvcCore/
Configured NuGet Audit to warn about transitive vulnerabilities.
System.ServiceModel.Security references with direct System.ServiceModel.Primitives references across supported target frameworks.claimsTransform delegate to be asynchronous via the new CreateSessionAsync() helper.NuGet package released:
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2/
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2.Mvc/
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2.MvcCore/
NuGet package released: https://www.nuget.org/packages/ITfoxtec.Identity.Saml2/ https://www.nuget.org/packages/ITfoxtec.Identity.Saml2.Mvc/ https://ww
Microsoft.Web.Infrastructure change to version 2.0.0, as version 2.0.1 has been unlisted.
Microsoft.Web.Infrastructure change to version 2.0.0, as version 2.0.1 has been unlisted.NuGet package released:
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2/
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2.Mvc/
https://www.nuget.org/packages/ITfoxtec.Identity.Saml2.MvcCore/
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Your coding agent can read these notes before it upgrades. Set up the MCP server →