NuGet · #2543 most downloaded on NuGet

Sustainsys.Saml2.AspNetCore2

2.11.012M downloads/moSustainsys/Saml2 ↗New releases in your daily digest, changelog included.

ASP.NET Core authentication handler for the SAML2 protocol, compatible with Asp.Net Core 2.X and 3.X

Last release 2 years ago
no release in 18 months
Release timing varies
gaps range from 4 weeks to 1.5 years
Some releases are documented
notes for 12 of 21 stable releases
1 version withdrawn
withdrawn after publishing
127 years old
22 releases · first in 1900

Release timeline

22 releases since 1900

Releases

2.11.02 Mar 2025
Support RSA-OAEP for encrypted XML with specified mask generation function
Version 2.11.0

Support RSA-OAEP for encrypted XML with specified mask generation function

Built in support for AES-GCM (.NET 8 target only)

Dropped .NET Standard 2.1 target in favour of .NET 8.

See GitHub milestone issue list for details.
Additional notes
Support RSA-OAEP for encrypted XML with specified mask generation function.

Built in support for AES-GCM (.NET 8 target only).

Dropped .NET Standard 2.1 target in favour of .NET 8.

Update dependencies to minimal non-vulnerable version.
Open source →
2.10.09 Aug 2024
See GitHub milestone issue list for details.
Version 2.10.0

FIPS compliance

See GitHub milestone issue list for details.
Additional notes
Support for FIPS Compliance

From the same repository

Sustainsys/Saml2

Sustainsys.Saml2NuGetSAML2 protocol support. Do not use directly, use the high level package for your platform.

2.9.219 Sept 2023Security2 sources agree

Security Fix: Bind state and assertion to response issuer.

Version 2.9.2

Security Fix: Bind state and assertion to response issuer.
Security Fix: Bind request state to module path to prevent substitution.

Version 2.9.1

Support modern crypto providers

Version 2.9.0

Add runtime detection for .NET 5+
Deserialize LogoutResponse

See GitHub milestone issue list for details.

2.9.112 Jun 2023

Support modern crypto providers

Version 2.9.1

Support modern crypto providers

Version 2.9.0

Add runtime detection for .NET 5+
Deserialize LogoutResponse

Version 2.8.0

Add runtime detection for .NET 5
Enable adding support for AES-GCM (http://www.w3.org/2009/xmlenc11#aes128-gcm)
Bug fix: Do not crash on duplicate language entries for localized strings in metadata

See GitHub milestone issue list for details.

Additional notes

support modern crypto providers

Open source →

2.9.020 Dec 2021Security2 sources agree

Security Fix: Ensure received token is a bearer token

Version 2.9.0

Add runtime detection for .NET 5+
Deserialize LogoutResponse

Version 2.8.0

Add runtime detection for .NET 5
Enable adding support for AES-GCM (http://www.w3.org/2009/xmlenc11#aes128-gcm)
Bug fix: Do not crash on duplicate language entries for localized strings in metadata

Version 2.7.0

Security Fix: Ensure received token is a bearer token
Compatibility flag to allow unsigned logout responses

Version 2.6.0

Xml Created Notifications

Version 2.5.0

Security Fix: Token Replay Detection
Configuration of TokenValidationParameters
Use CookieManager in Asp.Net Core and Owin
Bug fixes to Artifact binding, AuthnRequest, Owin Logout

See GitHub milestone issue list for details.

2.8.022 Dec 2020Security2 sources agree

Security Fix: Ensure received token is a bearer token

Version 2.8.0

Add runtime detection for .NET 5
Enable adding support for AES-GCM (http://www.w3.org/2009/xmlenc11#aes128-gcm)
Bug fix: Do not crash on duplicate language entries for localized strings in metadata

Version 2.7.0

Security Fix: Ensure received token is a bearer token
Compatibility flag to allow unsigned logout responses

Version 2.6.0

Xml Created Notifications

Version 2.5.0

Security Fix: Token Replay Detection
Configuration of TokenValidationParameters
Use CookieManager in Asp.Net Core and Owin
Bug fixes to Artifact binding, AuthnRequest, Owin Logout

See GitHub milestone issue list for details.

2.7.021 Apr 2020Security2 sources agree

Security Fix: Ensure received token is a bearer token.

Version 2.7.0

Security Fix: Ensure received token is a bearer token.
Compatibility flag to allow unsigned logout responses

Version 2.6.0

Xml Created Notifications

Version 2.5.0

Security Fix: Token Replay Detection
Configuration of TokenValidationParameters
Use CookieManager in Asp.Net Core and Owin
Bug fixes to Artifact binding, AuthnRequest, Owin Logout

See GitHub milestone issue list for details.

2.6.027 Mar 2020Security

Security Fix: Token Replay Detection

Version 2.6.0

Xml Created Notifications

Version 2.5.0

Security Fix: Token Replay Detection
Configuration of TokenValidationParameters
Use CookieManager in Asp.Net Core and Owin
Bug fixes to Artifact binding, AuthnRequest, Owin Logout

Version 2.4.0

SameSite cookie update for Chrome 80
TokenValidationParametersCreated notification
Bug Fix: Handle query string with =
Improved error messages

See GitHub milestone issue list for details.

Additional notes

Xml Created Notifications

Open source →

2.5.024 Mar 2020Security

Security Fix: Token Replay Detection

Version 2.5.0

Security Fix: Token Replay Detection
Configuration of TokenValidationParameters
Use CookieManager in Asp.Net Core and Owin
Bug fixes to Artifact binding, AuthnRequest, Owin Logout

Version 2.4.0

SameSite cookie update for Chrome 80
TokenValidationParametersCreated notification
Bug Fix: Handle query string with =
Improved error messages

See GitHub milestone issue list for details.

2.4.017 Jan 2020

SameSite cookie update for Chrome 80

Version 2.4.0

SameSite cookie update for Chrome 80
TokenValidationParametersCreated notification
Bug Fix: Handle query string with =
Improved error messages

Version 2.3.0

Support for RequestAbstractType.Extensions - EIDAS compatibility
Mark correlation cookie as essential
CSP Hash for POST binding
Support specifying ReturnUrl through RelayState
Remove .NET Standard dependencies when targeting .NET Framework

Version 2.2.0

Support TLS Client Certificates for Artifact Resolve

See GitHub milestone issue list for details.