Sustainsys SAML2 Sample for ASP.NET Core WebAPI without Identity

For anyone who still needs assistance on this issue, I pushed a full working example to github which uses a .Net Core WebAPI for backend and an Angular client using the WebAPI. you can find the example from here:

https://github.com/hmacat/Saml2WebAPIAndAngularSpaExample

As it turned out, the various errors I've been getting were due to my solution being hosted inside docker container. This caused a little malfunction in internal aspnet keychain. More details can be found here (docker is mentioned almost at the end of the article):

https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/configuration/overview?tabs=aspnetcore2x&view=aspnetcore-2.2

Long story short, for the code to be working I had to add only these lines:

services.AddDataProtection()        .PersistKeysToFileSystem(new DirectoryInfo("/some/volume/outside/docker")); // it needs to be outside container, even better if it's in redis or other common resource

It fixed everything, which includes:

• Sign-in action to external cookie
• Unsolicited SSO calls
• Exceptions with data protection key chain

So it was very difficult to find, since exceptions thrown by the code didn't point out what's going on (and the unsolicited SSO calls made me think that the SSO provider was wrongly configured). It was only when I disassembled the Saml2 package and tried various code pieces one by one I finally encoutered proper exception (about the key chain) which in turned led me to an article about aspnet data protection.

I provide this answer so that maybe it will help someone, and I added docker tag for proper audience.