Insufficient Logging in Aspnet with Saml

Insufficient logging in an ASP.NET application that uses SAML for authentication creates significant detection and forensic gaps. When SAML responses and protocol events are not recorded with adequate detail, security teams cannot reliably reconstruct authentication attempts, trace identity provider (IdP) interactions, or detect tampered assertions.

In SAML flows, the service provider (SP) receives a signed SAML assertion from the IdP. If ASP.NET does not log the full assertion content (including NameID, attributes, and conditions), the nonce, and the InResponseTo field, it becomes difficult to detect replay attacks or malformed responses. Without logs of the SAML protocol binding steps (e.g., HTTP-POST or redirect bindings), an attacker may bypass consent or manipulation checks and the incident will go unnoticed.

Additionally, insufficient logging around certificate validation and SAML signature verification removes visibility into trust failures. For example, if an ASP.NET SAML handler does not log when a signature fails to validate due to an expired or mismatched certificate, defenders lose early warning of configuration drift or active tampering. Logging should capture the endpoint URL, the Issuer, the SessionIndex, and any authentication outcome, while ensuring sensitive data is masked to avoid privacy violations.

middleBrick scans such an unauthenticated ASP.NET endpoint and can surface missing logging controls as part of its 12 checks, including Input Validation and Data Exposure. While middleBrick detects and reports the gap, it does not fix or block; it provides prioritized findings with remediation guidance to help teams instrument robust SAML event logging.

To remediate insufficient logging in ASP.NET with SAML, instrument key events in the SAML protocol pipeline. Log protocol metadata, validation outcomes, and security-sensitive decisions without recording raw sensitive assertions. Below are concrete examples using the Sustainsys.Saml2 library, a common SAML implementation for ASP.NET.

1. Enable detailed SAML protocol logging

Configure diagnostics to capture SAML protocol events. In appsettings.json, adjust the LogLevel for SAML components:

{
  "Logging": {
    "LogLevel": {
      "Sustainsys.Saml2": "Information"
    }
  }
}

In Program.cs, ensure diagnostic sources are observed and routed to your logging provider (e.g., Serilog, console):

using Microsoft.Extensions.DependencyInjection;
using Sustainsys.Saml2;
using Sustainsys.Saml2.WebSso;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddSaml(builder.Configuration.GetSection("Saml"));

// Add custom logging for SAML events
builder.Logging.AddFilter("Sustainsys.Saml2", LogLevel.Information);
builder.Services.AddSingleton<ISamlResponseLogger, CustomSamlLogger>();

var app = builder.Build();
app.UseSaml();
app.Run();

2. Implement a custom SAML response logger

Create a logger that records key fields from the SAML response while redacting sensitive data:

using Microsoft.Extensions.Logging;
using Sustainsys.Saml2;
using Sustainsys.Saml2.Response;

public class CustomSamlLogger : ISamlResponseLogger
{
    private readonly ILogger _logger;

    public CustomSamlLogger(ILoggerFactory loggerFactory) => _logger = loggerFactory.CreateLogger("SamlResponse");

    public void Log(Saml2Response response, string binding, bool isPassive)
    {
        if (response is null) return;

        // Log non-sensitive protocol metadata
        _logger.LogInformation(
            "SAML Response received | Issuer: {Issuer}, NameID: {NameId}, InResponseTo: {InResponseTo}, Status: {StatusCode}, Binding: {Binding}, Timestamp: {Timestamp}",
            response.ClaimsIdentity?.Issuer ?? "unknown",
            response.NameId?.Value ?? "[redacted]",
            response.InResponseTo ?? "[unsolicited]",
            response.Status?.StatusCode?.ToString() ?? "[no status]",
            binding,
            DateTime.UtcNow.ToString("o")
        );

        // Optional: log assertion conditions (not raw attributes)
        if (response.Assertion?.Conditions?.NotBefore is not null || response.Assertion?.Conditions?.NotOnOrAfter is not null)
        {
            _logger.LogWarning(
                "SAML assertion conditions | NotBefore: {NotBefore}, NotOnOrAfter: {NotOnOrAfter}",
                response.Assertion.Conditions?.NotBefore,
                response.Assertion.Conditions?.NotOnOrAfter
            );
        }

        // Log signature validation outcome
        if (response.SigningKey is null)
        {
            _logger.LogCritical("SAML signature validation failed for response from {Issuer}", response.ClaimsIdentity?.Issuer ?? "unknown");
        }
    }
}

3. Log authentication results and anomalies

Hook into the authentication pipeline to record success/failure and anomalies such as missing InResponseTo or unexpected Issuer:

using Microsoft.AspNetCore.Authentication;
using Microsoft.Extensions.Logging;
using System.Security.Claims;
using System.Threading.Tasks;

public class SamlAuditMiddleware
{
    private readonly RequestDelegate _next;
    private readonly ILogger _logger;

    public SamlAuditMiddleware(RequestDelegate next, ILoggerFactory loggerFactory)
    {
        _next = next;
        _logger = loggerFactory.CreateLogger("SamlAudit");
    }

    public async Task Invoke(HttpContext context)
    {
        var result = await context.AuthenticateAsync(SamlDefaults.AuthenticationScheme);
        if (result?.Succeeded == true && result.Principal is ClaimsIdentity identity)
        {
            _logger.LogInformation(
                "SAML authentication succeeded | Issuer: {Issuer}, NameID: {NameId}, SessionIndex: {SessionIndex}",
                identity.Issuer,
                identity.Name,
                identity.FindFirst(Saml2ClaimTypes.SessionIndex)?.Value ?? "[none]"
            );
        }
        else if (context.Request.Path.StartsWithSegments("/Saml2"))
        {
            _logger.LogWarning("SAML authentication failed or incomplete for request path {Path}", context.Request.Path);
        }

        await _next(context);
    }
}

Register the middleware after authentication in Program.cs:

app.UseAuthentication();
app.UseMiddleware<SamlAuditMiddleware>();
app.UseAuthorization();

4. Record IdP metadata and certificate thumbprints

Log IdP entity descriptors and key material fingerprints to detect configuration changes:

using Sustainsys.Saml2.Metadata;
using System.Security.Cryptography.X509Certificates;

public class SamlMetadataLogger
{
    public static void LogIdpMetadata(EntityDescriptor entity)
    {
        if (entity is null) return;
        foreach (var idpItem in entity.RoleDescriptors.OfType<IdPSsoDescriptor>())
        {
            foreach (var key in idpItem.Keys)
            {
                var cert = key.Certificate;
                if (cert is not null)
                {
                    var thumbprint = cert.Thumbprint;
                    var expires = cert.NotAfter.ToString("o");
                    // Log without storing private material
                    Console.WriteLine($"[SAML] IdP Key | Issuer: {entity.EntityId}, Thumbprint: {thumbprint}, Expires: {expires}");
                }
            }
        }
    }
}