Extract Keys from Federation Meta Data File (ADFS)

Introduction

This is a simple routine to extract the keys from a Federationmetadata.xml file as found on ADFS sites.

Using the Code

To use the code, download the zip file above which contains a simple Visual Studio (2013) project that wraps the below code with a basic file dialog. Nothing special in this code, it simple opens the FederationMetaData.xml file as a string, injects the necessary namespaces to query for the Key Node and then extracts the Base64-encoded key.

That key is loaded into an x509 object in order to write it to disk as a .cer file.

Which allows import into the certificate store on Windows.

It writes out to the same location from which the XML was opened, using a hard-coded name of "ExtractedCertificate" and an iterator number (as usually the keys are included seven times in a Federation Meta data file).

Not more than five minutes' work, but hope it saves someone from scratching their head at how to import the certificate needed to trust a remote ADFS system.

        System.IO.StreamReader sr = new
                System.IO.StreamReader(openFileDialog1.FileName);
                XmlDocument document = new XmlDocument();
                document.LoadXml(sr.ReadToEnd());
                XmlNode root = document.DocumentElement;
                XmlNamespaceManager NS = new XmlNamespaceManager(document.NameTable);
                NS.AddNamespace("default", "urn:oasis:names:tc:SAML:2.0:metadata");
                NS.AddNamespace("keys", "http://www.w3.org/2000/09/xmldsig");
                NS.AddNamespace("keys1", "http://www.w3.org/2000/09/xmldsig#");
        sr.Close();
                 XmlNodeList cert = root.SelectNodes("descendant::keys1:X509Certificate", 
                 NS); ///KeyDescriptor/KeyInfo/X509Data/X509Certificate
                int i = 1;
                foreach (XmlNode thisNode in cert ){
                    string thisText = thisNode.InnerText;
                    byte[] keydata = Convert.FromBase64String(thisText);
                    var x509c = new X509Certificate2(keydata);
                    if(openFileDialog1.CheckPathExists){
                        string newCert = System.IO.Path.GetDirectoryName(openFileDialog1.FileName) + 
                        "\\ExtractedCertificate" + i + ".cer";
                        System.IO.File.WriteAllText(newCert, Convert.ToBase64String(x509c.Export(X509ContentType.Cert)));
                        i++;
                    }
                }