Azure-activedirectory-identitymodel-extensions-for-dotnet: Saml2 tokens should have signature as first element

[brentschmaltz]

The Saml2Serializer puts the signature as the last element.
Usually it is the first element. We should place it first.

[AndersAbel]

It shouldn't be first. It must be second, after the <Issuer> element.

Refer to the spec section 2.3.3 where this schema fragment is contained.

<element name="Assertion" type="saml:AssertionType"/> <complexType name="AssertionType"> <sequence> <element ref="saml:Issuer"/> <element ref="ds:Signature" minOccurs="0"/> <element ref="saml:Subject" minOccurs="0"/> <element ref="saml:Conditions" minOccurs="0"/> <element ref="saml:Advice" minOccurs="0"/> <choice minOccurs="0" maxOccurs="unbounded"> <element ref="saml:Statement"/> <element ref="saml:AuthnStatement"/> <element ref="saml:AuthzDecisionStatement"/> <element ref="saml:AttributeStatement"/> </choice> </sequence> <attribute name="Version" type="string" use="required"/> <attribute name="ID" type="ID" use="required"/> <attribute name="IssueInstant" type="dateTime" use="required"/> </complexType>

[brentschmaltz]

@AndersAbel yep, wherever the spec say.
@lovemaths can you take care of this.

[AndersAbel]

@brentschmaltz Sorry to such a pain, just complaining, all the time. I've read the SAML2 specs more times than I think is healthy...

[brentschmaltz]

@AndersAbel you are not being a pain. We appreciate you helping us get it right.