java - OIOSAML AuthnResponse : Unable to encrypt assertion

Question

我想实现一个简单的场景:

1. 试图访问 protected 信息系统资源的用户
2. 信息系统向身份提供者发送请求以对用户进行身份验证
3. 身份提供者验证用户是否有一个打开的 session ，如果没有 Activity session ，则执行用户身份验证(身份提供者将用户重定向到一个网页，他可以在其中输入用户名/密码 )
4. 如果用户认证成功，身份提供者向信息系统发送包含用户身份信息的语句集
5. 根据从身份提供者收到的信息，信息系统对用户进行身份验证以访问 protected 资源

作为信息系统(服务提供商)我使用 OIOSAML 。基于 Shibboleth 的远程 idP (在客户方面，我对此一无所知。只知道它是在Shibboleth的基础上编写的)

来自 docs :

The OIOSAML.java Service Provider package implements a Servlet-compliant SAML Service Provider for use in a SAML federation. The package implements all necessary functionality to work as a OIOSAML compliant Service Provider.

The main component of the package is a servlet filter which handles user authentication. The filter checks if the user is already authenticated, and if not, the user is redirected to the SAML Identity Provider. When the user returns with a SAML assertion, the assertion is validated, and a new session is created for the user. The application can access the received assertion and its attributes through a programming API.

IdP and Service Provider configuration is handled through standard SAML metadata.

我的 web.xml:

<?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_ID" version="2.4"
    xmlns="http://java.sun.com/xml/ns/j2ee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd" >

    <display-name>OIOSAML-J</display-name>

    <listener>
        <listener-class>dk.itst.oiosaml.sp.service.session.SessionDestroyListener</listener-class>
    </listener>

    <servlet>
        <servlet-name>SAMLDispatcherServlet</servlet-name>
        <servlet-class>dk.itst.oiosaml.sp.service.DispatcherServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>

    <servlet-mapping>
        <servlet-name>SAMLDispatcherServlet</servlet-name>
        <url-pattern>/saml/*</url-pattern>
    </servlet-mapping>

    <filter>
        <filter-name>LoginFilter</filter-name>
        <filter-class>dk.itst.oiosaml.sp.service.SPFilter</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>LoginFilter</filter-name>
        <url-pattern>/protected/*</url-pattern>
    </filter-mapping>

    <welcome-file-list>
        <welcome-file>index.jsp</welcome-file>
    </welcome-file-list>

</web-app>

我的 oiosaml-sp.properties:

# Properties used by oiosaml-j

# Reference to the location of the certificate used for signing SAML documents with - relative to ${oiosaml.home}
oiosaml-sp.certificate.location=./certificate/keystore

# Opaque/encrypted password to the certificate used for signing SAML documents
oiosaml-sp.certificate.password=some_password

# Required authentication level. 2=password, 3=certificate
oiosaml-sp.assurancelevel=2

# Name of the meta data file for the current service provider - overrides setting in brs-common.properties
common.saml2.metadata.sp.filename=SPMetadata.xml

# URI References to the current service provider
oiosaml-sp.uri.home=

# Whether to validate server certificates. Set to false in production.
# Used for artifact resolution.
oiosaml-sp.resolve.ignorecert=true

# Artifact resolution username and password. Only used the artifact profile is active.
oiosaml-sp.resolve.username=rolf.trifork.com
oiosaml-sp.resolve.password=rolf.trifork.com

已生成 AuthnRequest :

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
                     AssertionConsumerServiceURL="http://.../saml/SAMLAssertionConsumer"
                     Destination="https://someidentityprovider/idp/profile/SAML2/Redirect/SSO" ForceAuthn="false"
                     ID="_183...4" IsPassive="false"
                     IssueInstant="2014-07-10T05:48:02.564Z"
                     ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">some_information</saml2:Issuer>
</saml2p:AuthnRequest>

结果URLEncode字符串:

https://someidentityprovider/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fVL...x3%2B8w%2Fws%3D
&RelayState=_27a...b8d25d4df
&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23dsa-sha1
&Signature=MCwCFFIXyH...%3D

系统正常工作，当我通过 protected 映射执行请求时，我得到身份提供者的登录页面，我可以在其中输入一对登录名/密码以继续。但是，标识提供者发送此响应:

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="..."
                 ID="_3d00f0e5401c168ab42eeafc78726e5e" InResponseTo="_b67...3c10"
                 IssueInstant="2014-07-10T15:33:56.788Z" Version="2.0">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                  Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">
        https://.../shibboleth
    </saml2:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo>
            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
            <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
            <ds:Reference URI="#_3d00f0...726e5e">
                <ds:Transforms>
                    <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                </ds:Transforms>
                <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                <ds:DigestValue>yq/0...I=</ds:DigestValue>
            </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>
            IR76Xd51+Vwi...w==
        </ds:SignatureValue>
        <ds:KeyInfo>
            <ds:X509Data>
                <ds:X509Certificate>MIID...zQG</ds:X509Certificate>
            </ds:X509Data>
        </ds:KeyInfo>
    </ds:Signature>

    <saml2p:Status>
        <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"/>
        <saml2p:StatusMessage>Unable to encrypt assertion</saml2p:StatusMessage>
    </saml2p:Status>

</saml2p:Response>

所以，

<saml2p:Status>
   <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"/>
   <saml2p:StatusMessage>Unable to encrypt assertion</saml2p:StatusMessage>
</saml2p:Status>

这是什么意思以及如何克服它？

Answer 1

身份提供者需要拥有您的 OIOSAML 应用程序的公共(public)证书，以便能够在将响应发送回 OIOSAML 之前加密断言。错误消息可能表明它丢失了。

您能否验证包含您导入到 Shibboleth 的 OIOSAML 应用程序信息的 SAML 元数据是否包含元素 <md:KeyDescriptor use="encryption">有证书信息吗？

作为解决方法，您可以在 HTTPS 端口上部署 OIOSAML 应用程序(在元数据中生成 URL，例如 https://localdomain.com:8443/..。)并将元数据重新导入 Shibboleth。默认情况下，Shibboleth 不会尝试加密断言，以防断言通过加密 channel 返回给服务提供商应用程序。