Merge pull request #34 from schotime/master

Add CustomCertificateValidator property to Saml2Configuration

Author: Revsgaard

src/ITfoxtec.Identity.Saml2/Configuration/Saml2Configuration.cs

@@ -3,6 +3,7 @@
 using System.Collections.Generic;
 using System.Security.Cryptography.X509Certificates;
 using System.ServiceModel.Security;
+using System.IdentityModel.Selectors;
 
 namespace ITfoxtec.Identity.Saml2
 {
@@ -25,6 +26,7 @@ public class Saml2Configuration
         public List<X509Certificate2> SignatureValidationCertificates { get; protected set; } = new List<X509Certificate2>();
         public X509CertificateValidationMode CertificateValidationMode { get; set; } = X509CertificateValidationMode.ChainTrust;
         public X509RevocationMode RevocationMode { get; set; } = X509RevocationMode.Online;
+        public X509CertificateValidator CustomCertificateValidator { get; set; }
 
         public bool SaveBootstrapContext { get; set; } = false;
 

src/ITfoxtec.Identity.Saml2/Configuration/Saml2IdentityConfiguration.cs

@@ -1,5 +1,4 @@
-using System.Security.Cryptography.X509Certificates;
-using ITfoxtec.Identity.Saml2.Util;
+using System.ServiceModel.Security;
 #if NETFULL
 using ITfoxtec.Identity.Saml2.Tokens;
 using System;
@@ -8,6 +7,7 @@
 using System.IdentityModel.Tokens;
 #else
 using System.Linq;
+using ITfoxtec.Identity.Saml2.Util;
 using Microsoft.IdentityModel.Tokens;
 using System.Security.Claims;
 using System.IdentityModel.Selectors;
@@ -54,9 +54,25 @@ public static Saml2IdentityConfiguration GetIdentityConfiguration(Saml2Configura
                 RevocationMode = config.RevocationMode,
             };
 #endif
+
+            SetCustomCertificateValidator(configuration, config);
+
             return configuration;
         }
 
+        private static void SetCustomCertificateValidator(Saml2IdentityConfiguration configuration, Saml2Configuration config)
+        {
+            if (config.CertificateValidationMode == X509CertificateValidationMode.Custom)
+            {
+                if (config.CustomCertificateValidator is null)
+                {
+                    throw new Saml2ConfigurationException("A CustomCertificateValidator is required when setting CertificateValidationMode = X509CertificateValidationMode.Custom");
+                }
+
+                configuration.CertificateValidator = config.CustomCertificateValidator;
+            }
+        }
+
 #if NETFULL
         private static AudienceRestriction GetAudienceRestriction(bool audienceRestricted, IEnumerable<string> allowedAudienceUris)
         {