java - 在 SP(服务提供商)中导入 SAML SSO IDP 元数据时遇到问题

Question

我正在使用 Spring SAML 扩展来连接 ping 联邦 IDP 服务器。我导出了 ping 联邦 IDP 元数据 xml 并将其放入我们的应用程序(并在 securityContext.xml 文件中引用相同的文件)。现在，当我尝试启动我的应用程序时，spring saml 会抛出以下异常:

Caused by: org.opensaml.saml2.metadata.provider.MetadataProviderException: Error filtering metadata from C:\Drive E\workspace\enigma_master\etc\saml\idp.xml
at org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.processNonExpiredMetadata(AbstractReloadingMetadataProvider.java:399)
at org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.processNewMetadata(AbstractReloadingMetadataProvider.java:355)
at org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.refresh(AbstractReloadingMetadataProvider.java:261)
... 100 more
Caused by: org.opensaml.saml2.metadata.provider.FilterException: Signature trust establishment failed for metadata entry
at org.opensaml.saml2.metadata.provider.SignatureValidationFilter.verifySignature(SignatureValidationFilter.java:327)
at org.opensaml.saml2.metadata.provider.SignatureValidationFilter.processEntityDescriptor(SignatureValidationFilter.java:178)
at org.opensaml.saml2.metadata.provider.SignatureValidationFilter.doFilter(SignatureValidationFilter.java:156)
at org.opensaml.saml2.metadata.provider.AbstractMetadataProvider.filterMetadata(AbstractMetadataProvider.java:493)
at org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.processNonExpiredMetadata(AbstractReloadingMetadataProvider.java:395)
... 102 more

我在我的 samlkeystore 文件中导入了证书(位于标签 <ds:X509Certificate> 下的证书)，但仍然存在同样的问题。我用谷歌搜索了错误并按照建议:

• 我尝试删除 <ds:Signature> idp xml 文件中的标记。
• 通过在 ExtendedMetadataDelegate bean 中将属性metadataTrustCheck 设置为 false 来禁用签名验证

以上方法对我有用。但我不想修改/删除 IDP xml 文件中的标签，它应该按原样工作。请让我知道我做错了什么？另外我想知道<ds:Signature>有什么用？元数据 xml 中的标记以及为什么即使在 samlKeystore 文件中导入证书后它也不起作用。每个子标签的含义是什么，例如 <ds:SignedInfo> , <ds:CanonicalizationMethod> , <ds:SignatureMethod> , <ds:Reference> , <ds:Transform> , <ds:DigestMethod> , <ds:DigestValue> , <ds:SignatureValue> 。

示例 IDP 元数据 xml 文件

<md:EntityDescriptor ID="jsR9U9qdN-Tjy-hyM5k.nrQmQxF" cacheDuration="PT1440M" entityID="adeptia" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="#jsR9U9qdN-Tjy-hyM5k.nrQmQxF">
<ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>slepuncWspzM7KpqKkvsk0SVL8k5yse7FmATDYZhgqE=</ds:DigestValue>
</ds:Reference></ds:SignedInfo>
<ds:SignatureValue>oSkTcfU4DUYPXwtgnN8bjAOnkqgFCojef087d0F4ra1nsrWBOQVC1xesSambwAdOiCtnnhxQqp4b2LeUSazdb0bI5A0U65Wc2MeoyfC/5nAfiso3DCNBaz4vRrlkvzm7MlHyvDzTO0T/+lSVhfIVWbEZ58iXjUdyPgbCBSlY6+GLOW3UfdYV73ewNEyWuaAjJrC4qNgTrTZwBiVD2WNM4qWgRkBxzJz+cgZLbvu/5XRfnNgeYT6OEAR2322okH01GtuuPYB7jgwM2TXJhH6eVR6FapCtJ5aUwUywCdg3YyvzzEqHWW8fDnTLNEbZbokpqbtTwvncMaOb1hhVfZr1pQ==</ds:SignatureValue>
</ds:Signature><md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" WantAuthnRequestsSigned="true"><md:KeyDescriptor use="signing"><ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:X509Data><ds:X509Certificate>MIIDNDCCAhygAwIBAgIGAVgFivO1MA0GCSqGSIb3DQEBCwUAMFsxCzAJBgNVBAYTAklOMQswCQYDVQQIEwJVUDEOMAwGA1UEBxMFTm9pZGExDTALBgNVBAoTBFBpbmcxDTALBgNVBAsTBFBpbmcxETAPBgNVBAMTCFBpbmdDZXJ0MB4XDTE2MTAyNzA5NDkwMloXDTE3MTAyNzA5NDkwMlowWzELMAkGA1UEBhMCSU4xCzAJBgNVBAgTAlVQMQ4wDAYDVQQHEwVOb2lkYTENMAsGA1UEChMEUGluZzENMAsGA1UECxMEUGluZzERMA8GA1UEAxMIUGluZ0NlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDW1OC4pSwb11rUhA8JoZtkqXebWWaw9lZgXQmqFlIpMSbmeTNayQ+cAAtO+4QNLbtmZta1wEs+XJ4ho3Yy7EoaE+ebmiGnwBtqzq9ZHYqqT9RJ8kOaqZpYo/uXAtVPHE4/kH8xLY+lToF+EL4QG1gbi3CO/yTWMPnkGZOJDpcFvTRFWXCmLqgxvjrpt82bG58CUHiwx26vJO7q8OiMqiVIzzzrVqTR0XmyKtiV+5AfK5Qdl7Z9o8zMKl8O4+d/lWfhV21bcU/aj4Wcr3Os3SQm37OP9T4qhSFOWhGe+JOmW+dDUAFg/EeU0yOUF7/xaOk3D2No+SsrJiPogdVCGO2lAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAICZDjz9Hfccvqdo7LopyG+0bKor+Ybh60bzcTPblXSv5v7Zy4JRfQF/k0CbmV7bBTvZ+kgDWXZP4YakfIWivSEDnT+xnVkF+sRlOtLmwmJ3UDRVqRhR8V3aq7YkH4ltzG7B3oS05wpTrYHnb4xgOHx+isX4YzHVP+gHblU36Fo32vhLNoVi1G+7nlZY3iuug6Y9NU7HnppS8vMcRJn8dOvEykmPu/jiq72gcZIhnaszXIx7mJAy9qsg1iNuwSwjVhCRuP+o7xyUpaamlMxRRP2h3LpWGveXcidBe40uI6uFxE+ggE09F29GRCb7X9pPub+C+cnxg/rIKmrqxe/j1wU=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:ArtifactResolutionService index="0" Location="https://localhost:9031/idp/ARS.ssaml2" Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" isDefault="true"/><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://localhost:9031/idp/SSO.saml2"/><md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://localhost:9031/idp/SSO.saml2"/><md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://localhost:9031/idp/SSO.saml2"/><md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://localhost:9031/idp/SSO.saml2"/><saml:Attribute Name="name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/><saml:Attribute Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/></md:IDPSSODescriptor><md:ContactPerson contactType="administrative"/></md:EntityDescriptor>

Answer 1

此问题通常是由于缺少安装 Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files for JDK/JRE 8 引起的

还要仔细检查证书是否确实正确导入到 samlKeystore.jks