c# - 验证 SAML 断言上的签名

Question

我有两个签名，一个关于响应(验证)，一个关于嵌套的 SAML 断言(不验证)。这是我正在使用的压缩代码:

foreach (XmlElement node in xmlDoc.SelectNodes("//*[local-name()='Signature']"))
{// Verify this Signature block
    SignedXml signedXml = new SignedXml(node.ParentNode as XmlElement);
    signedXml.LoadXml(node);
    KeyInfoX509Data x509Data = signedXml.Signature.KeyInfo.OfType<KeyInfoX509Data>().First();

    // Verify certificate
    X509Certificate2 cert = x509Data.Certificates[0] as X509Certificate2;
    log.Info(string.Format("Cert s/n: {0}", cert.SerialNumber));
    VerifyX509Chain(cert);// Custom method

    // Check for approval
    X509Store store = new X509Store(StoreName.TrustedPublisher, StoreLocation.LocalMachine);
    store.Open(OpenFlags.ReadOnly);
    X509Certificate2Collection collection = store.Certificates.Find(X509FindType.FindBySerialNumber, cert.SerialNumber, true);
    Debug.Assert(collection.Count == 1);// Standing in for brevity

    // Verify signature
    signedXml.CheckSignature(cert, true);
}

为了完整起见，这里是 XML 的大纲:

<samlp2:Response Destination="http://www.testhabaGoba.com" ID="ResponseId_934151edfe060ceec3067670c2f0f1ea" IssueInstant="2013-09-24T14:33:29.507Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp2="urn:oasis:names:tc:SAML:2.0:protocol">
    ...
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        ...
    </ds:Signature>
    ...
    <saml2:Assertion ID="SamlAssertion-05fd8af7f2c9972e69cdbca612d3f3b8" IssueInstant="2013-09-24T14:33:29.496Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
        ...
        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
            ...
        </ds:Signature>
        ...
    </saml2:Assertion>
</samlp2:Response>

我也尝试过只对断言进行签名，但同样失败了。我究竟做错了什么？为什么 CheckSignature SAML 断言总是失败？

编辑事实证明，只有断言签名的那个是 Java 生成的 (OpenSAML)，并且有更多的障碍需要跳过。请指教。

Answer 1

此代码使用 Ultimate saml (http://www.componentpro.com/saml.net/) 验证 SAML 响应。它有助于验证响应中嵌套的 SAML 断言签名。

XmlDocument xmlDocument = new XmlDocument(); 
xmlDocument.Load(samlResponseXmlToVerify); 

XmlDocument xmlDocumentMetadata = new XmlDocument(); 
xmlDocumentMetadata.Load(samlMetadataXmlToExtractCertData); 

// Load the SAML response from the XML document. 
Response samlResponse = new Response(xmlDocument.DocumentElement); 

// Is it signed?  
if (samlResponse.IsSigned()) 
{ 
    // Validate the SAML response with the certificate.  
    if (!samlResponse.Validate(xmlDocumentMetadata.DocumentElement)) 
    { 
        throw new ApplicationException("SAML response signature is not valid."); 
    } 
} 

有关详细信息，请参阅此在线示例代码:http://www.componentpro.com/doc/saml/ComponentPro.Saml.SignableSamlObject.Validate().htm