SAML2 Assertion Query Request / Response Messages - part 3

AuthzDecision Query is used to determine some actions on some resources be allowed to a particular subject. This request message present Evidence such as AssertionIDRef , Assertion to verify subject.

AuthzDecision Query Request Message

	<?xml version="1.0" encoding="UTF-8"?>
	<saml2p:AuthzDecisionQuery xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" ID="_6b56f881-b953-4376-9d8c-9d0feba95e58" IssueInstant="2016-09-12T03:38:41.235Z" Resource="http://velozit.blogspot.com" Version="2.0">
	<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">travelocity.com</saml2:Issuer>
	<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
	<ds:SignedInfo>
	<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
	<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
	<ds:Reference URI="#_6b56f881-b953-4376-9d8c-9d0feba95e58">
	<ds:Transforms>
	<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
	<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
	</ds:Transforms>
	<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
	<ds:DigestValue>uWOdwDJnkahdJ+l7d4vnhdT/C/g=</ds:DigestValue>
	</ds:Reference>
	</ds:SignedInfo>
	<ds:SignatureValue>BhcLq4fqALyM39EHzdWopGAh7L7Wlmzl6amh1CIrg0RsdGnomLo7nRNPVoorvVOH5N53rOizK2UG
	wybySoa6Wux5IlfRvBGB5JEu7XnoU9gENxxJVatKN3PaV2JRidqYU4k9d5FrGIU03G3z9owAX1qu
	3PEfnMIsVtIcyDfXNlAowovA4sWazYUyIpGZfi7nUXYI2GhUV72PSiKRjNDZkCxIUH18YS2/eDgp
	8bsJ8FM0AqEr4Ufq3ByYkHg8yembHQWQJVNM60+mZ3zXhMV5Z/N6qduGbxQX4TVqXQ1GTaVozT69
	NX2/NVEZxbbxg86dd7gHlmA4HLVSqSXFrKm4wQ==</ds:SignatureValue>
	<ds:KeyInfo>
	<ds:X509Data>
	<ds:X509Certificate>MIIDezCCAmOgAwIBAgIEa4wPCDANBgkqhkiG9w0BAQsFADBuMQswCQYDVQQGEwJMSzEQMA4GA1UE
	CBMHd2VzdGVybjEQMA4GA1UEBxMHY29sb21ibzEUMBIGA1UEChMLc29hc2VjdXJpdHkxETAPBgNV
	BAsTCHNlY3VyaXR5MRIwEAYDVQQDEwlsb2NhbGhvc3QwHhcNMTYwNzEzMTczMDQ5WhcNMTYxMDEx
	MTczMDQ5WjBuMQswCQYDVQQGEwJMSzEQMA4GA1UECBMHd2VzdGVybjEQMA4GA1UEBxMHY29sb21i
	bzEUMBIGA1UEChMLc29hc2VjdXJpdHkxETAPBgNVBAsTCHNlY3VyaXR5MRIwEAYDVQQDEwlsb2Nh
	bGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCRo50ubPqW09rzptxmKIaeSjFP
	UbkmsMUn1jQvrH5vyumRjBKDY//uXQwcCAcmTw4Bb5RVdZVOiJPxQixQghBGgaVv3UobuilYtNuS
	/qEVZvnX4RBNkADOXXp+inf5a8OQYjVV7aac1bcSFx/4DgvcWT6mPLpm4dMVMhBWYye0gfPHKMIR
	1W1BR/+dJuZePJVa0xFzJ33CBA38vrqg6OuEsZY0fMMfFasyxepUlIECTkKq7ie5PP+31gqw9cAu
	bIfeO9HtXcQBC7GPgcCgRV7+azJS1MgxbpvlDHJnVxcTcX3IdMCrclCC87DJIMVpbDeK6oGSqbhu
	Kn69sqnq6e9PAgMBAAGjITAfMB0GA1UdDgQWBBRRWwyTdsm/QxyObtcHBKtH0EMQ2zANBgkqhkiG
	9w0BAQsFAAOCAQEANy3xYK8wD9EuKyXbAeEJs5jvoL/2cI4EOZfP1VKAa3SHv+AYPzxqmuyMpD2f
	6Tx9yyOP+0QNNynHMC6RPjz8Ib5GzSbvUfbJKXAU7GPc/7riKMJzv52NI8KqFdQ1Y7YiKAMs5dpJ
	QAhiLlRU9yuhljWqXQ5h8eVJ+vO+9+VPSctDuNpHrhbIZbwAd5Cf+Avp7VDdaU2UIG3Xg7AJkXRF
	Oa0pEVPW+brkq9uLYTA4bMcr+ROH9REUA0f1AuWfi4aVDFptfVwULCqT9PPliqoZxJEzqccGjWgf
	Q0NktrBaTVRQo5BPpfRja5l7ajYAPKL7vS3OGCF1Ycocq6Wa6WMj7g==</ds:X509Certificate>
	</ds:X509Data>
	</ds:KeyInfo>
	</ds:Signature>
	<saml2:Subject xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
	<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">admin</saml2:NameID>
	<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
	<saml2:SubjectConfirmationData NotOnOrAfter="2016-09-12T03:39:41.235Z" />
	</saml2:SubjectConfirmation>
	</saml2:Subject>
	<saml2:Action xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">read</saml2:Action>
	<saml2:Evidence xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
	<saml2:AssertionIDRef>_1434099d980e04bd9342468a0e803007</saml2:AssertionIDRef>
	</saml2:Evidence>
	</saml2p:AuthzDecisionQuery>

view raw authzdecision-request.xml hosted with ❤ by GitHub

AuthzDecision Query Response Message

	<?xml version="1.0" encoding="UTF-8"?>
	<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" ID="_1725af6bf301cf5e82992745009a7c37" IssueInstant="2016-09-12T03:38:46.662Z" Version="2.0">
	<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">localhost</saml2:Issuer>
	<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
	<ds:SignedInfo>
	<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
	<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
	<ds:Reference URI="#_1725af6bf301cf5e82992745009a7c37">
	<ds:Transforms>
	<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
	<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
	</ds:Transforms>
	<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
	<ds:DigestValue>8wCtxrM9Xv/uL2bqBDqZ+9mWdys=</ds:DigestValue>
	</ds:Reference>
	</ds:SignedInfo>
	<ds:SignatureValue>WItE0J8ZfZKWCozrZiYDCjOzF3cNFm8cneZRU9qdI+v+JE1Vwr8c4muYBdXcwXmeBuUDyu7/Pd0S
	LplwOyO3AmP3JY/3FEJYOKUzcKq34h3fiaVGJZGX3D0N/HC+YVTpn8KgchftwVdRxgngLFfZCtDW
	j3pIzvjq5W9UaEVdcqw=</ds:SignatureValue>
	<ds:KeyInfo>
	<ds:X509Data>
	<ds:X509Certificate>MIICNTCCAZ6gAwIBAgIES343gjANBgkqhkiG9w0BAQUFADBVMQswCQYDVQQGEwJVUzELMAkGA1UE
	CAwCQ0ExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxDTALBgNVBAoMBFdTTzIxEjAQBgNVBAMMCWxv
	Y2FsaG9zdDAeFw0xMDAyMTkwNzAyMjZaFw0zNTAyMTMwNzAyMjZaMFUxCzAJBgNVBAYTAlVTMQsw
	CQYDVQQIDAJDQTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzENMAsGA1UECgwEV1NPMjESMBAGA1UE
	AwwJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCUp/oV1vWc8/TkQSiAvTou
	sMzOM4asB2iltr2QKozni5aVFu818MpOLZIr8LMnTzWllJvvaA5RAAdpbECb+48FjbBe0hseUdN5
	HpwvnH/DW8ZccGvk53I6Orq7hLCv1ZHtuOCokghz/ATrhyPq+QktMfXnRS4HrKGJTzxaCcU7OQID
	AQABoxIwEDAOBgNVHQ8BAf8EBAMCBPAwDQYJKoZIhvcNAQEFBQADgYEAW5wPR7cr1LAdq+IrR44i
	QlRG5ITCZXY9hI0PygLP2rHANh+PYfTmxbuOnykNGyhM6FjFLbW2uZHQTY1jMrPprjOrmyK5sjJR
	O4d1DeGHT/YnIjs9JogRKv4XHECwLtIVdAbIdWHEtVZJyMSktcyysFcvuhPQK8Qc/E/Wq8uHSCo=</ds:X509Certificate>
	</ds:X509Data>
	</ds:KeyInfo>
	</ds:Signature>
	<saml2p:Status>
	<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
	</saml2p:Status>
	<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_673067040ddf49ce7b243e3f74c3ae9b" IssueInstant="2016-09-12T03:38:46.645Z" Version="2.0">
	<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">localhost</saml2:Issuer>
	<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
	<ds:SignedInfo>
	<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
	<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
	<ds:Reference URI="#_673067040ddf49ce7b243e3f74c3ae9b">
	<ds:Transforms>
	<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
	<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
	</ds:Transforms>
	<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
	<ds:DigestValue>d+d06BGDy8kM4LH/bj0HGKRTIYQ=</ds:DigestValue>
	</ds:Reference>
	</ds:SignedInfo>
	<ds:SignatureValue>kIujOVlRDHdRKMwjMNk9fbqU9/XhKC1a3bnqsoAEHQ03sbMFHa1XyW0Cq+PmHeAW7Wu1/ZaKK7bg
	I+kVhld6XjCh447/fA+hqnWFaVT4OT5fp3mbz3n4zWiMEy8ckVwpXw6AatsLRSRVQUIlSWlSL2gv
	/SuFDlCl1E5fqw7RYzI=</ds:SignatureValue>
	<ds:KeyInfo>
	<ds:X509Data>
	<ds:X509Certificate>MIICNTCCAZ6gAwIBAgIES343gjANBgkqhkiG9w0BAQUFADBVMQswCQYDVQQGEwJVUzELMAkGA1UE
	CAwCQ0ExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxDTALBgNVBAoMBFdTTzIxEjAQBgNVBAMMCWxv
	Y2FsaG9zdDAeFw0xMDAyMTkwNzAyMjZaFw0zNTAyMTMwNzAyMjZaMFUxCzAJBgNVBAYTAlVTMQsw
	CQYDVQQIDAJDQTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzENMAsGA1UECgwEV1NPMjESMBAGA1UE
	AwwJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCUp/oV1vWc8/TkQSiAvTou
	sMzOM4asB2iltr2QKozni5aVFu818MpOLZIr8LMnTzWllJvvaA5RAAdpbECb+48FjbBe0hseUdN5
	HpwvnH/DW8ZccGvk53I6Orq7hLCv1ZHtuOCokghz/ATrhyPq+QktMfXnRS4HrKGJTzxaCcU7OQID
	AQABoxIwEDAOBgNVHQ8BAf8EBAMCBPAwDQYJKoZIhvcNAQEFBQADgYEAW5wPR7cr1LAdq+IrR44i
	QlRG5ITCZXY9hI0PygLP2rHANh+PYfTmxbuOnykNGyhM6FjFLbW2uZHQTY1jMrPprjOrmyK5sjJR
	O4d1DeGHT/YnIjs9JogRKv4XHECwLtIVdAbIdWHEtVZJyMSktcyysFcvuhPQK8Qc/E/Wq8uHSCo=</ds:X509Certificate>
	</ds:X509Data>
	</ds:KeyInfo>
	</ds:Signature>
	<saml2:Subject>
	<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
	<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
	<saml2:SubjectConfirmationData NotOnOrAfter="2016-09-12T03:43:46.645Z" />
	</saml2:SubjectConfirmation>
	</saml2:Subject>
	<saml2:Conditions NotBefore="2016-09-12T03:38:46.645Z" NotOnOrAfter="2016-09-12T03:43:46.645Z">
	<saml2:AudienceRestriction>
	<saml2:Audience>travelocity.com</saml2:Audience>
	</saml2:AudienceRestriction>
	</saml2:Conditions>
	<saml2:AuthnStatement AuthnInstant="2016-09-12T03:38:46.651Z">
	<saml2:AuthnContext>
	<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef>
	</saml2:AuthnContext>
	</saml2:AuthnStatement>
	<saml2:AuthzDecisionStatement Decision="Permit" Resource="http://velozit.blogspot.com">
	<saml2:Action>read</saml2:Action>
	<saml2:Evidence>
	<saml2:AssertionIDRef>_1434099d980e04bd9342468a0e803007</saml2:AssertionIDRef>
	</saml2:Evidence>
	</saml2:AuthzDecisionStatement>
	</saml2:Assertion>
	</saml2p:Response>

view raw authzdecision-response.xml hosted with ❤ by GitHub

Customized Error Response Message

IDP must return Response message for each and every request which received from the SP. IDP can report errors in request message or server failures of it self.

Invalid Issuer Error Response 

	<?xml version="1.0" encoding="UTF-8"?>
	<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" ID="_86821f11e997cf59def1662fcd81bfcc" IssueInstant="2016-09-12T03:48:04.138Z" Version="2.0">
	<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">localhost</saml2:Issuer>
	<saml2p:Status>
	<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal" />
	<saml2p:StatusMessage>Issuer is Not Validated</saml2p:StatusMessage>
	</saml2p:Status>
	</saml2p:Response>

view raw invalid-issuer.xml hosted with ❤ by GitHub

Invalid SAML Version Error Response 

	<?xml version="1.0" encoding="UTF-8"?>
	<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" ID="_18e38d24ff417b80ec9b1b3fa10b18d6" IssueInstant="2016-09-12T03:53:24.736Z" Version="2.0">
	<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">localhost</saml2:Issuer>
	<saml2p:Status>
	<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:VersionMismatch" />
	<saml2p:StatusMessage>Invalid SAML version, expected version is 2.0</saml2p:StatusMessage>
	</saml2p:Status>
	</saml2p:Response>

view raw invalid-saml-version.xml hosted with ❤ by GitHub

Invalid Subject Error Response 

	<?xml version="1.0" encoding="UTF-8"?>
	<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" ID="_382ef8ef288e290953646d7b711ac290" IssueInstant="2016-09-12T06:04:37.509Z" Version="2.0">
	<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">localhost</saml2:Issuer>
	<saml2p:Status>
	<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester" />
	<saml2p:StatusMessage>Request subject is invalid</saml2p:StatusMessage>
	</saml2p:Status>
	</saml2p:Response>

view raw invalid-subject.xml hosted with ❤ by GitHub

Invalid SessionIndex or Auth-Context Error Response 

	<?xml version="1.0" encoding="UTF-8"?>
	<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" ID="_0d5879f191f41c43ba2e7eb91a16a0c1" IssueInstant="2016-09-12T04:03:26.299Z" Version="2.0">
	<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">localhost</saml2:Issuer>
	<saml2p:Status>
	<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester" />
	<saml2p:StatusMessage>Request message type does present any sessionindex or authncontextclassref</saml2p:StatusMessage>
	</saml2p:Status>
	</saml2p:Response>

view raw invalid-sessionindex-and-auth-context.xml hosted with ❤ by GitHub