java - OpenSaml 无法解码 Java 11 中的 x509 证书

Question

我正在尝试将 Shibboleth SP 应用程序转换到 Java 11。在 Java 8 下使用 IdP 进行身份验证可以正常工作，但在 11 中，在用户经过身份验证并返回到应用程序后，它会失败。

2019-03-14 09:21:37.329 DEBUG 21741 --- [nio-8080-exec-5] o.o.s.m.p.ChainingMetadataProvider       : Checking child metadata provider for entity descriptor with entity ID: https://...
2019-03-14 09:21:37.330 DEBUG 21741 --- [nio-8080-exec-5] o.o.s.m.p.AbstractMetadataProvider       : Searching for entity descriptor with an entity ID of ...
2019-03-14 09:21:37.331 DEBUG 21741 --- [nio-8080-exec-5] k.BasicProviderKeyInfoCredentialResolver : Found 0 key names: []
2019-03-14 09:21:37.331 DEBUG 21741 --- [nio-8080-exec-5] k.BasicProviderKeyInfoCredentialResolver : Processing KeyInfo child with qname: {http://www.w3.org/2000/09/xmldsig#}X509Data
2019-03-14 09:21:37.331 DEBUG 21741 --- [nio-8080-exec-5] k.BasicProviderKeyInfoCredentialResolver : Provider org.opensaml.xml.security.keyinfo.provider.RSAKeyValueProvider doesn't handle objects of type {http://www.w3.org/2000/09/xmldsig#}X509Data, skipping
2019-03-14 09:21:37.331 DEBUG 21741 --- [nio-8080-exec-5] k.BasicProviderKeyInfoCredentialResolver : Provider org.opensaml.xml.security.keyinfo.provider.DSAKeyValueProvider doesn't handle objects of type {http://www.w3.org/2000/09/xmldsig#}X509Data, skipping
2019-03-14 09:21:37.331 DEBUG 21741 --- [nio-8080-exec-5] k.BasicProviderKeyInfoCredentialResolver : Processing KeyInfo child {http://www.w3.org/2000/09/xmldsig#}X509Data with provider org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider
2019-03-14 09:21:37.331 DEBUG 21741 --- [nio-8080-exec-5] o.o.x.s.k.p.InlineX509DataProvider       : Attempting to extract credential from an X509Data
what kind of weird pkcs12 file has more than one alias?
what kind of weird pkcs12 file has more than one alias?
what kind of weird pkcs12 file has more than one alias?
what kind of weird pkcs12 file has more than one alias?
what kind of weird pkcs12 file has more than one alias?
what kind of weird pkcs12 file has more than one alias?
[ above message repeated about 50 times ...]
java.security.KeyStoreException: Uninitialized keystore
    at java.base/java.security.KeyStore.aliases(KeyStore.java:1267)
    at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:233)
    at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:165)
    at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:170)
    at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:175)
    at org.apache.commons.ssl.TrustMaterial.<clinit>(TrustMaterial.java:88)
    at org.opensaml.xml.security.x509.X509Util.decodeCertificate(X509Util.java:359)
    at org.opensaml.xml.security.keyinfo.KeyInfoHelper.getCertificate(KeyInfoHelper.java:201)
    at org.opensaml.xml.security.keyinfo.KeyInfoHelper.getCertificates(KeyInfoHelper.java:176)
    at org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.extractCertificates(InlineX509DataProvider.java:192)
    at org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.process(InlineX509DataProvider.java:126)
    at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfoChild(BasicProviderKeyInfoCredentialResolver.java:300)
    at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfoChildren(BasicProviderKeyInfoCredentialResolver.java:256)
    at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfo(BasicProviderKeyInfoCredentialResolver.java:190)
    at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.resolveFromSource(BasicProviderKeyInfoCredentialResolver.java:149)
    at org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:57)
    at org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:37)
    at org.opensaml.security.MetadataCredentialResolver.retrieveFromMetadata(MetadataCredentialResolver.java:275)
    at org.springframework.security.saml.trust.MetadataCredentialResolver.retrieveFromMetadata(MetadataCredentialResolver.java:123)
    at org.opensaml.security.MetadataCredentialResolver.resolveFromSource(MetadataCredentialResolver.java:178)
    at org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:57)
    at org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:37)
    at org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine.validate(ExplicitKeySignatureTrustEngine.java:98)
    at org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine.validate(ExplicitKeySignatureTrustEngine.java:49)
    at org.opensaml.ws.security.provider.BaseTrustEngineRule.evaluate(BaseTrustEngineRule.java:104)
    at org.opensaml.ws.security.provider.BaseTrustEngineRule.evaluate(BaseTrustEngineRule.java:91)
    at org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule.doEvaluate(SAMLProtocolMessageXMLSignatureSecurityPolicyRule.java:128)
    at org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule.evaluate(SAMLProtocolMessageXMLSignatureSecurityPolicyRule.java:107)
    at org.opensaml.ws.security.provider.BasicSecurityPolicy.evaluate(BasicSecurityPolicy.java:51)
    at org.opensaml.ws.message.decoder.BaseMessageDecoder.processSecurityPolicy(BaseMessageDecoder.java:132)
    at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:83)
    at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70)
    at org.springframework.security.saml.processor.SAMLProcessorImpl.retrieveMessage(SAMLProcessorImpl.java:105)
    at org.springframework.security.saml.processor.SAMLProcessorImpl.retrieveMessage(SAMLProcessorImpl.java:172)
    at org.springframework.security.saml.SAMLProcessingFilter.attemptAuthentication(SAMLProcessingFilter.java:85)
    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)

这是一个使用 spring-security-saml2-core 1.0.5.RELEASE 的 Spring Boot 应用程序。在 Oracle Java 8 下它可以工作，但在 OpenJDK 11 下身份验证失败并出现上述错误。

Answer 1

这是 Java 9 更改为 PKCS12 作为默认 keystore 的结果。有几个修复:

1. 如果使用 spring-security-saml2-core，请升级到 1.0.8-RELEASE。

2. 将默认 keystore 类型设置为 JKS:

   Security.setProperty("keystore.type", "jks");

更多信息:Spring Security Saml issue #263