feat: add test response 112, 113

italia · Jan 31, 2025 · dbaf671 · dbaf671
1 parent 04edadf
commit dbaf671
Show file tree

Hide file tree

Showing 4 changed files with 198 additions and 2 deletions.
diff --git a/spid-validator/config/test.json b/spid-validator/config/test.json
@@ -3646,7 +3646,87 @@
                 },
                 "sign_response": true,
                 "sign_assertion": false
-            }
+            },
+            "112": {
+                "name": "112. SAML Response Signature Verification Bypass - Assertion non firmata",
+                "description": "SAML Response firmata contenente primo elemento firmato correttamente e Assertion non firmata",
+                "path": "test/case-112.xml",
+                "response": {
+                    "NameIDNameQualifier": "",
+                    "Attributes": {
+                        "spidCode": "AGID-001",
+                        "name": "SpidValidator",
+                        "familyName": "AgID",
+                        "placeOfBirth": "Roma",
+                        "countyOfBirth": "RM",
+                        "dateOfBirth": "2000-01-01",
+                        "gender": "M",
+                        "companyName": "Agenzia per l'Italia Digitale",
+                        "registeredOffice": "Via Listz 21 00144 Roma",
+                        "fiscalNumber": "TINIT-GDASDV00A01H501J",
+                        "ivaCode": "VATIT-97735020584",
+                        "idCard": "CartaIdentità AA00000000 ComuneRoma 2018-01-01 2028-01-01",
+                        "expirationDate": "2028-01-01",
+                        "mobilePhone": "+393331234567",
+                        "email": "[email protected]",
+                        "address": "Via Listz 21 00144 Roma",
+                        "digitalAddress": "[email protected]",
+                        "companyFiscalNumber": "TINIT-GDASDV00A01H501J",
+                        "domicileStreetAddress": "Via Listz 21",
+                        "domicilePostalCode": "00144",
+                        "domicileMunicipality": "Roma",
+                        "domicileProvince": "RM",
+                        "domicileNation": "IT"
+                    }
+                },
+                "sign_response": true,
+                "sign_assertion": false,
+                "sign_credentials": {
+                    "signatureAlgorithm": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
+                    "certificate": "MIIDljCCAn6gAwIBAgIJAMSLv+GOwGWAMA0GCSqGSIb3DQEBCwUAMGAxCzAJBgNVBAYTAklUMQ4wDAYDVQQIDAVJdGFseTENMAsGA1UEBwwEUm9tZTENMAsGA1UECgwEQWdJRDENMAsGA1UECwwEQWdJRDEUMBIGA1UEAwwLYWdpZC5nb3YuaXQwHhcNMTkwNDA4MTc1MTMwWhcNMjAwNDA3MTc1MTMwWjBgMQswCQYDVQQGEwJJVDEOMAwGA1UECAwFSXRhbHkxDTALBgNVBAcMBFJvbWUxDTALBgNVBAoMBEFnSUQxDTALBgNVBAsMBEFnSUQxFDASBgNVBAMMC2FnaWQuZ292Lml0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsswE3L6ZbMWALv5fw73NmdZB5es3QaLNd3hq8sVVndDZUnM7yMHkYwPmlh1rFj82jPr2L9nasi32v6i283dsGCUxRH3VQo2Fi4awqvzx9g3mnd2p+CJKqN/xQuFyXkmDy7wKIopkv9EKJSFyyn9Y2h5FiKYucQoqQ2KJItt2y6tcTbhBRa7fMx99UPt1y5np31+oR4/BYWqLBtApMfGaXXDRNw/DBzmeew/uwC7tARMMG51MRBCZ83Mr5fIGeQZaYmDNCi+mIultLCVAZLqlv5h8p9bTAHNkNRpCh/V/I+q/L7Ajxfe/HEbydhJRyUjA0pmC4pAfvMlyDtQXMhh3FQIDAQABo1MwUTAdBgNVHQ4EFgQUodPRXj6pRrDfV011IiDnEOqnoMEwHwYDVR0jBBgwFoAUodPRXj6pRrDfV011IiDnEOqnoMEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEABkraIDMLDmpATNjR0uIu01gUOfIJMLWi75Ec03JGE/ljj2Kap7FO/RgqT5pmIUorb65rPlwsiP6Bv5Q7crDQMzVJdZwPzbboGlZR/dcqmQThgY4aOp7xcrmUCm3tWgwP52nw3QpLdVoiufy+5+MSuig6dklRqvx0tLGWgG2daUbdRtpEl8KtERMbVjoZGUqQE+WpIoKqxz2R84YY024XlMhRvxRAabFpYCNg5fAw0kRRXj3Zxmg7AdLzMStXHA/bked4ZoX6uJ19qLTOCLhlufQu8m3FL5Go5VL+qDdrNg7XYLxT1I5h1wtfebCA/e1IzHZmcUcAGVex4HgaAQwTNA==",
+                    "privateKey": "MIIEpAIBAAKCAQEAsswE3L6ZbMWALv5fw73NmdZB5es3QaLNd3hq8sVVndDZUnM7yMHkYwPmlh1rFj82jPr2L9nasi32v6i283dsGCUxRH3VQo2Fi4awqvzx9g3mnd2p+CJKqN/xQuFyXkmDy7wKIopkv9EKJSFyyn9Y2h5FiKYucQoqQ2KJItt2y6tcTbhBRa7fMx99UPt1y5np31+oR4/BYWqLBtApMfGaXXDRNw/DBzmeew/uwC7tARMMG51MRBCZ83Mr5fIGeQZaYmDNCi+mIultLCVAZLqlv5h8p9bTAHNkNRpCh/V/I+q/L7Ajxfe/HEbydhJRyUjA0pmC4pAfvMlyDtQXMhh3FQIDAQABAoIBACi5PVZF904GAfcyKv+7aGvkmCfVFkXV3fSbMcjP13tViVo1MuW7+9ftmISSeMSda0BbHN2zQhOZUn0+4US865roRbty6bL55vPrnqujZz0C14cXaNJChTzHnPz9un3tQp6R2sEZQm9KHoRshOfIb6VmhbHlH+jRRuUIOXH+CKXEpTPDU4Th+fdoYEOQY7NFHoobPrQ8IegYgODrWX2pTYf9AA5RitBP0Ju4lePgJX000T7WRpkSkAgi6arWzHzf5YUyAIATIVvm0RkuLIn9Q6YDQJa3lEmhEub4LZA6EpnqJYEjmfcOp5rPEKtq8tPWyuKvlT6bzHdtXz5zSG5Bo9UCgYEA6T8UAgcgRRJDYhKhsuhzwk3qahi0XqBJJp+XO8fdQXEh783P6pv5uYR1QUdDtgFOP05NEGz0Mzkyx5qxqlOr0yXlj0Tajb64S+5jyo8dqB2zxj0M8NLCxbQMvFN88tAHCJMPZeKOyq83XgWff2GzXqbQ9yh+5jauejW7z7zDEjsCgYEAxD0pLEFuBPeS1Fzz0P2UmsvKDbViqd9BlVwNwOR3YtSzT5hihUt1qVK22EVqlSWzF+QmAK76FQMoXiiQ22fNxTcaviNj2qZ9xhadS6RuF2MbxXVVQzXY4Oie/+mZg37fP0JZCQdlwOYp4UN4ZDf7NWJC5WJph4kx9Hj1liJGNu8CgYEAiOhhkh8kreZebv6Isz8GU5LweX4uwSxMQ8OBPbG/CV6ikOO5mvgayO4a9UojUH3LtBT93xpU7IwyZj9C8btTLAkeic3ciz7bZpZzNL50pe1pTH8hTWoosWtR3mkS+mNo/Xt0mlU1g3r9gM7EJDzw0CoSlkDK285U857+sp0V02kCgYBpCnPnhH5nmj21/qtjytioozzcaaMOWrq4QDX8ck6VUFVK3b6equ2oXOYSjdWnUC61MyJEa2ThqncJL52aU84JKp3d+QOSHlxkk+ZOfw2O5zYOU+f3ufMFMH8rbNcHU/ob2l/ePV9yCcGRGpRu0KhewuIb9rmWGxHqUnTikCYVcQKBgQDUWuS6hNq5qUSCIGL5e8CMmc/wSAvQFgxZV4VgJdPexykaJc4LKoFYqbRSyOSJ2vpxxWa6qIPU0+kgNZT7lBf8JOd4MIg5sg6Q8hIQk/I6cTM3F3ehpsKoq9K7IcJQQWqHgkONEFeghIZH0nzhnwrtVuFZiCzc7c671MmJMhnPZQ=="
+                }
+            },
+            "113": {
+                "name": "113. SAML Response Signature Verification Bypass - Assertion corrotta",
+                "description": "SAML Response firmata contenente primo elemento firmato correttamente e Assertion con firma non valida",
+                "path": "test/case-112.xml",
+                "response": {
+                    "NameIDNameQualifier": "",
+                    "Attributes": {
+                        "spidCode": "AGID-001",
+                        "name": "SpidValidator",
+                        "familyName": "AgID",
+                        "placeOfBirth": "Roma",
+                        "countyOfBirth": "RM",
+                        "dateOfBirth": "2000-01-01",
+                        "gender": "M",
+                        "companyName": "Agenzia per l'Italia Digitale",
+                        "registeredOffice": "Via Listz 21 00144 Roma",
+                        "fiscalNumber": "TINIT-GDASDV00A01H501J",
+                        "ivaCode": "VATIT-97735020584",
+                        "idCard": "CartaIdentità AA00000000 ComuneRoma 2018-01-01 2028-01-01",
+                        "expirationDate": "2028-01-01",
+                        "mobilePhone": "+393331234567",
+                        "email": "[email protected]",
+                        "address": "Via Listz 21 00144 Roma",
+                        "digitalAddress": "[email protected]",
+                        "companyFiscalNumber": "TINIT-GDASDV00A01H501J",
+                        "domicileStreetAddress": "Via Listz 21",
+                        "domicilePostalCode": "00144",
+                        "domicileMunicipality": "Roma",
+                        "domicileProvince": "RM",
+                        "domicileNation": "IT"
+                    }
+                },
+                "sign_response": true,
+                "sign_assertion": true,
+                "sign_credentials": {
+                    "signatureAlgorithm": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
+                    "certificate": "MIIDljCCAn6gAwIBAgIJAMSLv+GOwGWAMA0GCSqGSIb3DQEBCwUAMGAxCzAJBgNVBAYTAklUMQ4wDAYDVQQIDAVJdGFseTENMAsGA1UEBwwEUm9tZTENMAsGA1UECgwEQWdJRDENMAsGA1UECwwEQWdJRDEUMBIGA1UEAwwLYWdpZC5nb3YuaXQwHhcNMTkwNDA4MTc1MTMwWhcNMjAwNDA3MTc1MTMwWjBgMQswCQYDVQQGEwJJVDEOMAwGA1UECAwFSXRhbHkxDTALBgNVBAcMBFJvbWUxDTALBgNVBAoMBEFnSUQxDTALBgNVBAsMBEFnSUQxFDASBgNVBAMMC2FnaWQuZ292Lml0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsswE3L6ZbMWALv5fw73NmdZB5es3QaLNd3hq8sVVndDZUnM7yMHkYwPmlh1rFj82jPr2L9nasi32v6i283dsGCUxRH3VQo2Fi4awqvzx9g3mnd2p+CJKqN/xQuFyXkmDy7wKIopkv9EKJSFyyn9Y2h5FiKYucQoqQ2KJItt2y6tcTbhBRa7fMx99UPt1y5np31+oR4/BYWqLBtApMfGaXXDRNw/DBzmeew/uwC7tARMMG51MRBCZ83Mr5fIGeQZaYmDNCi+mIultLCVAZLqlv5h8p9bTAHNkNRpCh/V/I+q/L7Ajxfe/HEbydhJRyUjA0pmC4pAfvMlyDtQXMhh3FQIDAQABo1MwUTAdBgNVHQ4EFgQUodPRXj6pRrDfV011IiDnEOqnoMEwHwYDVR0jBBgwFoAUodPRXj6pRrDfV011IiDnEOqnoMEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEABkraIDMLDmpATNjR0uIu01gUOfIJMLWi75Ec03JGE/ljj2Kap7FO/RgqT5pmIUorb65rPlwsiP6Bv5Q7crDQMzVJdZwPzbboGlZR/dcqmQThgY4aOp7xcrmUCm3tWgwP52nw3QpLdVoiufy+5+MSuig6dklRqvx0tLGWgG2daUbdRtpEl8KtERMbVjoZGUqQE+WpIoKqxz2R84YY024XlMhRvxRAabFpYCNg5fAw0kRRXj3Zxmg7AdLzMStXHA/bked4ZoX6uJ19qLTOCLhlufQu8m3FL5Go5VL+qDdrNg7XYLxT1I5h1wtfebCA/e1IzHZmcUcAGVex4HgaAQwTNA==",
+                    "privateKey": "MIIEpAIBAAKCAQEAsswE3L6ZbMWALv5fw73NmdZB5es3QaLNd3hq8sVVndDZUnM7yMHkYwPmlh1rFj82jPr2L9nasi32v6i283dsGCUxRH3VQo2Fi4awqvzx9g3mnd2p+CJKqN/xQuFyXkmDy7wKIopkv9EKJSFyyn9Y2h5FiKYucQoqQ2KJItt2y6tcTbhBRa7fMx99UPt1y5np31+oR4/BYWqLBtApMfGaXXDRNw/DBzmeew/uwC7tARMMG51MRBCZ83Mr5fIGeQZaYmDNCi+mIultLCVAZLqlv5h8p9bTAHNkNRpCh/V/I+q/L7Ajxfe/HEbydhJRyUjA0pmC4pAfvMlyDtQXMhh3FQIDAQABAoIBACi5PVZF904GAfcyKv+7aGvkmCfVFkXV3fSbMcjP13tViVo1MuW7+9ftmISSeMSda0BbHN2zQhOZUn0+4US865roRbty6bL55vPrnqujZz0C14cXaNJChTzHnPz9un3tQp6R2sEZQm9KHoRshOfIb6VmhbHlH+jRRuUIOXH+CKXEpTPDU4Th+fdoYEOQY7NFHoobPrQ8IegYgODrWX2pTYf9AA5RitBP0Ju4lePgJX000T7WRpkSkAgi6arWzHzf5YUyAIATIVvm0RkuLIn9Q6YDQJa3lEmhEub4LZA6EpnqJYEjmfcOp5rPEKtq8tPWyuKvlT6bzHdtXz5zSG5Bo9UCgYEA6T8UAgcgRRJDYhKhsuhzwk3qahi0XqBJJp+XO8fdQXEh783P6pv5uYR1QUdDtgFOP05NEGz0Mzkyx5qxqlOr0yXlj0Tajb64S+5jyo8dqB2zxj0M8NLCxbQMvFN88tAHCJMPZeKOyq83XgWff2GzXqbQ9yh+5jauejW7z7zDEjsCgYEAxD0pLEFuBPeS1Fzz0P2UmsvKDbViqd9BlVwNwOR3YtSzT5hihUt1qVK22EVqlSWzF+QmAK76FQMoXiiQ22fNxTcaviNj2qZ9xhadS6RuF2MbxXVVQzXY4Oie/+mZg37fP0JZCQdlwOYp4UN4ZDf7NWJC5WJph4kx9Hj1liJGNu8CgYEAiOhhkh8kreZebv6Isz8GU5LweX4uwSxMQ8OBPbG/CV6ikOO5mvgayO4a9UojUH3LtBT93xpU7IwyZj9C8btTLAkeic3ciz7bZpZzNL50pe1pTH8hTWoosWtR3mkS+mNo/Xt0mlU1g3r9gM7EJDzw0CoSlkDK285U857+sp0V02kCgYBpCnPnhH5nmj21/qtjytioozzcaaMOWrq4QDX8ck6VUFVK3b6equ2oXOYSjdWnUC61MyJEa2ThqncJL52aU84JKp3d+QOSHlxkk+ZOfw2O5zYOU+f3ufMFMH8rbNcHU/ob2l/ePV9yCcGRGpRu0KhewuIb9rmWGxHqUnTikCYVcQKBgQDUWuS6hNq5qUSCIGL5e8CMmc/wSAvQFgxZV4VgJdPexykaJc4LKoFYqbRSyOSJ2vpxxWa6qIPU0+kgNZT7lBf8JOd4MIg5sg6Q8hIQk/I6cTM3F3ehpsKoq9K7IcJQQWqHgkONEFeghIZH0nzhnwrtVuFZiCzc7c671MmJMhnPZQ=="
+                }
+            }             
         }
     },
     "test-logout": {

diff --git a/spid-validator/server/package.json b/spid-validator/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "spid-validator",
-  "version": "1.10.6",
+  "version": "1.11.0",
   "description": "Tool for validating Service Provider compliance to SPID response from Identity Provider",
   "main": "spid-validator",
   "author": "Michele D'Amico (damikael) - AgID",

diff --git a/spid-validator/test/case-112.xml b/spid-validator/test/case-112.xml
@@ -0,0 +1,45 @@
+<samlp:Response
+    Destination="{{AssertionConsumerURL}}"
+    ID="{{ResponseID}}"
+    InResponseTo="{{AuthnRequestID}}" 
+    IssueInstant="{{IssueInstant}}"
+    Version="2.0" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
+    <md:EntityDescriptor ID="_1a870acd4227546978eb24e2bb050b0eeb967164a5" entityID="https://spid-saml-check.linfaware.linfaservice.it" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><ds:Reference URI="#_1a870acd4227546978eb24e2bb050b0eeb967164a5"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>mJH0VW2H3F62LoDYlQ/5LcdPMejKEG/w7yC+Ssli5U8=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>EIuPY04Ql+2fuwnVTObJmwNl6btV3c+Am945DPlqw3PZuOf5ZqLzIT6ci02sSFkC2i0VRvgbVnjBMSXg4KeDajx/3PzVk2iAEMFiEg63fFEnfW/ruvAsF3/TYSuOO+2cEqSFpaCeHiSW4WAKHu/7mXJhGKut3WOyJsVhuniOxwC4WW763BW7y0j1FA0Fn38cnFOUanKQSgBvJLVKx8usV7he1AgV+x3bl/sO+PeocWItLoma40msiSIaADXfK7YCHXRkgksITXSIGTMCkmCr3R3fpqyCsdHAk4JGxayTvELURcEyG7L/nMP0rquKGFDaBUvUagXlhYm0xXhGz0vEWA==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIEGDCCAwCgAwIBAgIJAOrYj9oLEJCwMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYTAklUMQ4wDAYDVQQIEwVJdGFseTENMAsGA1UEBxMEUm9tZTENMAsGA1UEChMEQWdJRDESMBAGA1UECxMJQWdJRCBURVNUMRQwEgYDVQQDEwthZ2lkLmdvdi5pdDAeFw0xOTA0MTExMDAyMDhaFw0yNTAzMDgxMDAyMDhaMGUxCzAJBgNVBAYTAklUMQ4wDAYDVQQIEwVJdGFseTENMAsGA1UEBxMEUm9tZTENMAsGA1UEChMEQWdJRDESMBAGA1UECxMJQWdJRCBURVNUMRQwEgYDVQQDEwthZ2lkLmdvdi5pdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK8kJVo+ugRrbbv9xhXCuVrqi4B7/MQzQc62ocwlFFujJNd4m1mXkUHFbgvwhRkQqo2DAmFeHiwCkJT3K1eeXIFhNFFroEzGPzONyekLpjNvmYIs1CFvirGOj0bkEiGaKEs+/umzGjxIhy5JQlqXE96y1+Izp2QhJimDK0/KNij8I1bzxseP0Ygc4SFveKS+7QO+PrLzWklEWGMs4DM5Zc3VRK7g4LWPWZhKdImC1rnS+/lEmHSvHisdVp/DJtbSrZwSYTRvTTz5IZDSq4kAzrDfpj16h7b3t3nFGc8UoY2Ro4tRZ3ahJ2r3b79yK6C5phY7CAANuW3gDdhVjiBNYs0CAwEAAaOByjCBxzAdBgNVHQ4EFgQU3/7kV2tbdFtphbSA4LH7+w8SkcwwgZcGA1UdIwSBjzCBjIAU3/7kV2tbdFtphbSA4LH7+w8SkcyhaaRnMGUxCzAJBgNVBAYTAklUMQ4wDAYDVQQIEwVJdGFseTENMAsGA1UEBxMEUm9tZTENMAsGA1UEChMEQWdJRDESMBAGA1UECxMJQWdJRCBURVNUMRQwEgYDVQQDEwthZ2lkLmdvdi5pdIIJAOrYj9oLEJCwMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAJNFqXg/V3aimJKUmUaqmQEEoSc3qvXFITvT5f5bKw9yk/NVhR6wndL+z/24h1OdRqs76blgH8k116qWNkkDtt0AlSjQOx5qvFYh1UviOjNdRI4WkYONSw+vuavcx+fB6O5JDHNmMhMySKTnmRqTkyhjrch7zaFIWUSV7hsBuxpqmrWDoLWdXbV3eFH3mINA5AoIY/m0bZtzZ7YNgiFWzxQgekpxd0vcTseMnCcXnsAlctdir0FoCZztxMuZjlBjwLTtM6Ry3/48LMM8Z+lw7NMciKLLTGQyU8XmKKSSOh0dGh5Lrlt5GxIIJkH81C0YimWebz8464QPL3RbLnTKg+c=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><md:IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><md:KeyDescriptor use="signing"><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIEGDCCAwCgAwIBAgIJAOrYj9oLEJCwMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYTAklUMQ4wDAYDVQQIEwVJdGFseTENMAsGA1UEBxMEUm9tZTENMAsGA1UEChMEQWdJRDESMBAGA1UECxMJQWdJRCBURVNUMRQwEgYDVQQDEwthZ2lkLmdvdi5pdDAeFw0xOTA0MTExMDAyMDhaFw0yNTAzMDgxMDAyMDhaMGUxCzAJBgNVBAYTAklUMQ4wDAYDVQQIEwVJdGFseTENMAsGA1UEBxMEUm9tZTENMAsGA1UEChMEQWdJRDESMBAGA1UECxMJQWdJRCBURVNUMRQwEgYDVQQDEwthZ2lkLmdvdi5pdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK8kJVo+ugRrbbv9xhXCuVrqi4B7/MQzQc62ocwlFFujJNd4m1mXkUHFbgvwhRkQqo2DAmFeHiwCkJT3K1eeXIFhNFFroEzGPzONyekLpjNvmYIs1CFvirGOj0bkEiGaKEs+/umzGjxIhy5JQlqXE96y1+Izp2QhJimDK0/KNij8I1bzxseP0Ygc4SFveKS+7QO+PrLzWklEWGMs4DM5Zc3VRK7g4LWPWZhKdImC1rnS+/lEmHSvHisdVp/DJtbSrZwSYTRvTTz5IZDSq4kAzrDfpj16h7b3t3nFGc8UoY2Ro4tRZ3ahJ2r3b79yK6C5phY7CAANuW3gDdhVjiBNYs0CAwEAAaOByjCBxzAdBgNVHQ4EFgQU3/7kV2tbdFtphbSA4LH7+w8SkcwwgZcGA1UdIwSBjzCBjIAU3/7kV2tbdFtphbSA4LH7+w8SkcyhaaRnMGUxCzAJBgNVBAYTAklUMQ4wDAYDVQQIEwVJdGFseTENMAsGA1UEBxMEUm9tZTENMAsGA1UEChMEQWdJRDESMBAGA1UECxMJQWdJRCBURVNUMRQwEgYDVQQDEwthZ2lkLmdvdi5pdIIJAOrYj9oLEJCwMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAJNFqXg/V3aimJKUmUaqmQEEoSc3qvXFITvT5f5bKw9yk/NVhR6wndL+z/24h1OdRqs76blgH8k116qWNkkDtt0AlSjQOx5qvFYh1UviOjNdRI4WkYONSw+vuavcx+fB6O5JDHNmMhMySKTnmRqTkyhjrch7zaFIWUSV7hsBuxpqmrWDoLWdXbV3eFH3mINA5AoIY/m0bZtzZ7YNgiFWzxQgekpxd0vcTseMnCcXnsAlctdir0FoCZztxMuZjlBjwLTtM6Ry3/48LMM8Z+lw7NMciKLLTGQyU8XmKKSSOh0dGh5Lrlt5GxIIJkH81C0YimWebz8464QPL3RbLnTKg+c=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://spid-saml-check.linfaware.linfaservice.it/samlsso" ResponseLocation="https://spid-saml-check.linfaware.linfaservice.it/samlsso"/><md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://spid-saml-check.linfaware.linfaservice.it/samlsso" ResponseLocation="https://spid-saml-check.linfaware.linfaservice.it/samlsso"/><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat><md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://spid-saml-check.linfaware.linfaservice.it/samlsso"/><md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://spid-saml-check.linfaware.linfaservice.it/samlsso"/></md:IDPSSODescriptor></md:EntityDescriptor>
+    <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">{{Issuer}}</saml:Issuer>
+
+    <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
+    <saml:Assertion ID="{{AssertionID}}" IssueInstant="{{IssueInstant}}"
+        Version="2.0" xmlns:xs="http://www.w3.org/2001/XMLSchema"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+        <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">{{Issuer}}</saml:Issuer>
+        <saml:Subject>
+            <saml:NameID 
+                Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
+                NameQualifier="{{NameIDNameQualifier}}">
+                    {{NameID}}
+            </saml:NameID>
+            <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
+                <saml:SubjectConfirmationData 
+                    InResponseTo="{{AuthnRequestID}}"
+                    NotOnOrAfter="{{NotOnOrAfter}}"
+                    Recipient="{{AssertionConsumerURL}}" />
+            </saml:SubjectConfirmation>
+        </saml:Subject>
+        <saml:Conditions 
+            NotBefore="{{IssueInstant}}" 
+            NotOnOrAfter="{{NotOnOrAfter}}" >
+            <saml:AudienceRestriction>
+                <saml:Audience>{{Audience}}</saml:Audience>
+            </saml:AudienceRestriction>
+        </saml:Conditions> 
+        <saml:AuthnStatement 
+            AuthnInstant="{{AuthnIstant}}"
+            SessionIndex="{{SessionIndex}}" >
+            <saml:AuthnContext>
+                <saml:AuthnContextClassRef>{{AuthnContextClassRef}}</saml:AuthnContextClassRef>
+            </saml:AuthnContext>
+        </saml:AuthnStatement>
+        {{Attributes}}
+    </saml:Assertion>
+</samlp:Response>