java - 使用 SAMLResponse token

Question

基于 SAML sp 的身份验证具有以下简短的工作流程。

• 用户想在 sp 访问应用程序。
• sp 将 SAMLRequest token 发送给 idp。
• idp 使用它并生成 SAMLResponse token 。
• idp 将此 SAMLResponse token 发送到 sp 给出的 AC-URL。

我的问题是 sp 如何使用此 SAMLResponse token 。这是什么逻辑？如果我能得到一些 JAVA 代码帮助，那将是有益的。

Answer 1

下一个食谱对我有用:

1. 获取 SAMLResponse token 并将其解码并膨胀:

   // Base64 decode
   Base64 base64Decoder = new Base64();
   byte[] xmlBytes = encodedXmlString.getBytes("UTF-8");
   byte[] base64DecodedByteArray = base64Decoder.decode(xmlBytes);
   
   // Inflate (uncompress) the AuthnRequest data
   // First attempt to unzip the byte array according to DEFLATE (rfc 1951)
   
   Inflater inflater = new Inflater(true);
   inflater.setInput(base64DecodedByteArray);
   // since we are decompressing, it's impossible to know how much space we
   // might need; hopefully this number is suitably big
   byte[] xmlMessageBytes = new byte[5000];
   int resultLength = inflater.inflate(xmlMessageBytes);
   
   if (!inflater.finished()) {
       throw new RuntimeException("didn't allocate enough space to hold "
               + "decompressed data");
   }
   
   inflater.end();
   
   String decodedResponse = new String(xmlMessageBytes, 0, resultLength,
           "UTF-8");
   
   return decodedResponse;
   

2. 解析生成的 XML。在这里您可以获得所需的信息，例如，用它创建一个 POJO(这是一个用于解析 LogoutRequest 的示例代码，但类似于响应):

   // Parse the XML. SAX approach, we just need the ID attribute
   SAXParserFactory saxParserFactory = SAXParserFactory.newInstance();
   
   // If we want to validate the doc we need to load the DTD
   // saxParserFactory.setValidating(true);
   
   // Get a SAXParser instance
   SAXParser saxParser = saxParserFactory.newSAXParser();
   
   // Parse it
   XMLhandler xmLhandler = new XMLhandler();
   saxParser.parse(new ByteArrayInputStream(xmlLogoutRequest.getBytes()),
           xmLhandler);
   
   // Return the SamlVO
   return xmLhandler.getSamlVO();
   

对于我的用例，我只对几个元素感兴趣，所以我使用 SAX:

public class XMLhandler extends DefaultHandler {

    private SamlVO samlVO;

    public XMLhandler() {
        samlVO = new SamlVO();
    }

    @Override
    public void startElement(String uri, String localName, String qName,
        Attributes attributes) throws SAXException {

        // Managing a LogoutRequest means that we are going to build a LogoutResponse
        if (qName.equals("samlp:LogoutRequest")) {
            // The ID value of a request will be the LogoutResponse's InReponseTo attribute 
            samlVO.setInResponseTo(attributes.getValue("ID"));
            // From the destination we can get the Issuer element
            String destination = attributes.getValue("Destination");
            if (destination != null) {
                URL destinationUrl = null;
                try {
                    destinationUrl = new URL(destination);
                } catch (MalformedURLException e) {
                     // TODO: We could set the server hostname (take it from a property), but this URL SHOULD be well formed!
                     e.printStackTrace();
                }
                samlVO.setIssuer(destinationUrl.getHost());
            }
        }   
    }

    public SamlVO getSamlVO() {
        return samlVO;
    }

}

希望对你有帮助，

路易斯

PS:您也可以使用像 OpenSAML 这样的库

DefaultBootstrap.bootstrap();

HTTPRedirectDeflateDecoder decode = new HTTPRedirectDeflateDecoder(new BasicParserPool());
BasicSAMLMessageContext<LogoutRequest, ?, ?> messageContext = new BasicSAMLMessageContext<LogoutRequest, SAMLObject, SAMLObject>();
messageContext.setInboundMessageTransport(new HttpServletRequestAdapter(request));
decode.decode(messageContext);
XMLObjectBuilderFactory builderFactory = org.opensaml.Configuration.getBuilderFactory();
LogoutRequestBuilder logoutRequestBuilder = (LogoutRequestBuilder) builderFactory.getBuilder(LogoutRequest.DEFAULT_ELEMENT_NAME);
LogoutRequest logoutRequest = logoutRequestBuilder.buildObject();
logoutRequest = (LogoutRequest) messageContext.getInboundMessage();

但请准备好在您的 CLASSPATH 中包含一些库!!!