个人中心
gpt4 book ai didi

spring-security - 配置 saml-sample (SP) 以与 Okta (IdP) 一起使用

转载 作者：行者123 更新时间：2023-12-01 02:26:26 25 4
gpt4 key购买 nike

Okta 是用于 SAML 登录的 IdP。我有一个 Okta 的 super 管理员用户。

我尝试使用 Spring 的 saml-sample 项目作为我的 SP(服务提供商)。当我在 Okta 系统中配置它(spring-saml-sample)时，我需要在我的 SP 上提供一些数据，例如“回发 URL”、“收件人”和“受众限制”。

在嗅探 Okta 的文档后，我发现了这一点:

观众限制 – 这是服务提供商的实体 ID。它将由 SP 提供并且必须完全匹配。请查阅 SP 文档以获取此信息。

收件人 – 输入服务提供者的断言消费者服务 URL 。请查阅 SP 文档以获取此信息。
所以我想出这个 URL 应该是:
http://srv101.watchdox.net/spring-security-saml2-sample/saml/SSO/alias/defaultAlias

回贴网址 – 这是 SAML SP 端点(即您的用户将登录的位置)

SAML 响应的目的地 – 这是 saml 断言的预期目标。除非由 SP 指定，否则这通常与回发 URL 相同。请查阅 SP 文档以获取此信息。

问题:

我的应用程序 (spring-saml-sample) 有一个“欢迎”页面，用户可以在其中选择他想要登录的 IdP。所以我选择“Okta”IdP，然后我被重定向到 Okta 进行登录(完美到这里)，但登录后，我没有将我重定向回我的应用程序(到 protected 资源)，而是留在 Okta系统并查看它们的框架。我确实在那里看到了我的应用程序。当我点击它时，我会进入我的第一页，选择 IdP。

我相信问题出在我的 URL 或 SAML 响应上...
任何人有想法吗？

如果有帮助，请在此处粘贴请求和响应。

我在这里粘贴了 SAML 请求和响应，以防万一它可能会有所帮助。请注意，响应中的状态代码是“成功”!

有什么问题？我错过了什么？

要求:

POST https://watchdox.okta.com/app/template_saml_2_0/k3gvyf0mGFVVCVQBYTTA/sso/saml HTTP/1.1
Host: watchdox.okta.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://srv101.watchdox.net/spring-security-saml2-sample/saml/login/alias/defaultAlias?idp=http%3A%2F%2Fwww.okta.com%2Fk3gvyf0mGFVVCVQBYTTA
Content-Type: application/x-www-form-urlencoded
Content-Length: 3906

HTTP/?.? 200 OK
Server: nginx/1.2.6
Date: Thu, 18 Apr 2013 08:49:39 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="HONK"
Set-Cookie: sid=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
t=default; Path=/
X-Okta-backend: webapp09e.prod.saasure.com
Cache-Control: no-cache, public
Pragma: no-cache
Expires: 0
Content-Language: en-US
Content-Encoding: gzip

SAML 请求: 
<saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
                     AssertionConsumerServiceURL="https://srv101.watchdox.net:443/spring-security-saml2-sample/saml/SSO/alias/defaultAlias"
                     Destination="https://watchdox.okta.com/app/template_saml_2_0/k3gvyf0mGFVVCVQBYTTA/sso/saml"
                     ForceAuthn="false"
                     ID="a32a5d9jfge33c9b46gdaddid8gd41b"
                     IsPassive="false"
                     IssueInstant="2013-04-18T08:49:38.141Z"
                     ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                     Version="2.0"
                     >
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">com.watchdox.ohad</saml2:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo>
            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
            <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
            <ds:Reference URI="#a32a5d9jfge33c9b46gdaddid8gd41b">
                <ds:Transforms>
                    <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                </ds:Transforms>
                <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
                <ds:DigestValue>blwZT1B5451jbzeB9m0ogyGQuFY=</ds:DigestValue>
            </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>RZeXySsMfy+iBglUngrCHg2XoaA4WzAkLrB/zhjRfqFQS45avePlF8f19N+MHoFSirI08R08lXNJqdT/+0tKEujwsluCzFMnOCVPhtZIs7DblxqD+nR0XmF9+fKt91z/KQRtGLQtO/bsl3X3dmkUULGUWBxi8ga9jyTnkGwMFjE8J/Ba0P9eZjLV9YV/Piui/3B1XbhezVIIAvPNOpwQzK1kSA19bwlSejCjsf1Xe9kLXoCdf56ykjGDSdj2HpEVKQcjbu2nfPTFAXRTehx6h5qiKVl5R1DdDtFfq9EOXpZgy5pcu4bHqDhNAMwhZCu57fIIRR5IWuC6YUAXTDFXbg==</ds:SignatureValue>
        <ds:KeyInfo>
            <ds:X509Data>
                <ds:X509Certificate>MIIDUjCCAjqgAwIBAgIEUOLIQTANBgkqhkiG9w0BAQUFADBrMQswCQYDVQQGEwJGSTEQMA4GA1UE
CBMHVXVzaW1hYTERMA8GA1UEBxMISGVsc2lua2kxGDAWBgNVBAoTD1JNNSBTb2Z0d2FyZSBPeTEM
MAoGA1UECwwDUiZEMQ8wDQYDVQQDEwZhcG9sbG8wHhcNMTMwMTAxMTEyODAxWhcNMjIxMjMwMTEy
ODAxWjBrMQswCQYDVQQGEwJGSTEQMA4GA1UECBMHVXVzaW1hYTERMA8GA1UEBxMISGVsc2lua2kx
GDAWBgNVBAoTD1JNNSBTb2Z0d2FyZSBPeTEMMAoGA1UECwwDUiZEMQ8wDQYDVQQDEwZhcG9sbG8w
ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCXqP0wqL2Ai1haeTj0alwsLafhrDtUt00E
5xc7kdD7PISRA270ZmpYMB4W24Uk2QkuwaBp6dI/yRdUvPfOT45YZrqIxMe2451PAQWtEKWF5Z13
F0J4/lB71TtrzyH94RnqSHXFfvRN8EY/rzuEzrpZrHdtNs9LRyLqcRTXMMO4z7QghBuxh3K5gu7K
qxpHx6No83WNZj4B3gvWLRWv05nbXh/F9YMeQClTX1iBNAhLQxWhwXMKB4u1iPQ/KSaal3R26pON
UUmu1qVtU1quQozSTPD8HvsDqGG19v2+/N3uf5dRYtvEPfwXN3wIY+/R93vBA6lnl5nTctZIRsyg
0Gv5AgMBAAEwDQYJKoZIhvcNAQEFBQADggEBAFQwAAYUjso1VwjDc2kypK/RRcB8bMAUUIG0hLGL
82IvnKouGixGqAcULwQKIvTs6uGmlgbSG6Gn5ROb2mlBztXqQ49zRvi5qWNRttir6eyqwRFGOM6A
8rxj3Jhxi2Vb/MJn7XzeVHHLzA1sV5hwl/2PLnaL2h9WyG9QwBbwtmkMEqUt/dgixKb1Rvby/tBu
RogWgPONNSACiW+Z5o8UdAOqNMZQozD/i1gOjBXoF0F5OksjQN7xoQZLj9xXefxCFQ69FPcFDeEW
bHwSoBy5hLPNALaEUoa5zPDwlixwRjFQTc5XXaRpgIjy/2gsL8+Y5QRhyXnLqgO67BlLYW/GuHE=</ds:X509Certificate>
            </ds:X509Data>
        </ds:KeyInfo>
    </ds:Signature>
</saml2p:AuthnRequest>

Okta 回复: 
POST http://srv101.watchdox.net/spring-security-saml2-sample/ HTTP/1.1
Host: srv101.watchdox.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 7863

HTTP/?.? 302 Found
Date: Thu, 18 Apr 2013 08:51:57 GMT
Server: Apache
Location: https://srv101.watchdox.net/spring-security-saml2-sample/
Content-Length: 241
Keep-Alive: timeout=30, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

SAML 响应: 
<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
                 Destination="http://srv101.watchdox.net/spring-security-saml2-sample/"
                 ID="id141234960903909491594058959"
                 InResponseTo="a32a5d9jfge33c9b46gdaddid8gd41b"
                 IssueInstant="2013-04-18T08:51:49.819Z"
                 Version="2.0"
                 >
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                  Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
                  >http://www.okta.com/k3gvyf0mGFVVCVQBYTTA</saml2:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo>
            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
            <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
            <ds:Reference URI="#id141234960903909491594058959">
                <ds:Transforms>
                    <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                </ds:Transforms>
                <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
                <ds:DigestValue>nCrBE9jowt9QAOk5ipw1SFnb248=</ds:DigestValue>
            </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>lwSHBmy4Hqt3XjbnPni6PePFFCn9hUJb7K4jh3xAyUum+y59TUYftphi00lFhnFZXsV5Tj75zLru3JX1jt7bdT73wsYS6ccNcyOvZpJvNiqbBeUmydK45DBrzIVxDA9CWS94+PTH4rrWT5+OEWURBxwhv9BiKiFrLb60YIp6Q3o=</ds:SignatureValue>
        <ds:KeyInfo>
            <ds:X509Data>
                <ds:X509Certificate>MIICmzCCAgSgAwIBAgIGAT1+4eJ9MA0GCSqGSIb3DQEBBQUAMIGQMQswCQYDVQQGEwJVUzETMBEG
A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU
MBIGA1UECwwLU1NPUHJvdmlkZXIxETAPBgNVBAMMCHdhdGNoZG94MRwwGgYJKoZIhvcNAQkBFg1p
bmZvQG9rdGEuY29tMB4XDTEzMDMxODE5MDE0NVoXDTQzMDMxODE5MDI0NVowgZAxCzAJBgNVBAYT
AlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQK
DARPa3RhMRQwEgYDVQQLDAtTU09Qcm92aWRlcjERMA8GA1UEAwwId2F0Y2hkb3gxHDAaBgkqhkiG
9w0BCQEWDWluZm9Ab2t0YS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL/raSnE0EXQ
mPgkSwyv8HIDPpmvU6prdySiWJSB3YztIC29VuneZbT0dFAOjAy6e/3NN7HjvBQU83YjhgBA43+U
f/7kwC2V8e5qi92J/pTrAWPB/UmTbCEVoCkR4BxSXr4bJ3dhk6eIPDGgOiuWjNCMTXoYX+aS1tsA
JDx0bXf5AgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAfiBOI+/mpP52Qsg6Ea1jVN/mGm4snvKl6Nlh
5sYGhGw5zXBVDU4pI9ulm/8QZsCAlYZXltZ+eif7CRzy2VZvDVMGH3g69AD2xHveYr8UNYSjnLyB
ZPpVJVOysH7UgtBqNcHm0l00g4uUV2d52WcDiz85q/KjTBB9OjRdGVhkcow=</ds:X509Certificate>
            </ds:X509Data>
        </ds:KeyInfo>
    </ds:Signature>
    <saml2p:Status xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
        <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
    </saml2p:Status>
    <saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                     ID="id14123496090473949894445897"
                     IssueInstant="2013-04-18T08:51:49.819Z"
                     Version="2.0"
                     >
        <saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
                      xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                      >http://www.okta.com/k3gvyf0mGFVVCVQBYTTA</saml2:Issuer>
        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
            <ds:SignedInfo>
                <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
                <ds:Reference URI="#id14123496090473949894445897">
                    <ds:Transforms>
                        <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
                        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                    </ds:Transforms>
                    <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
                    <ds:DigestValue>D/wZzyBDL0RXwrf7d44mvuysYz0=</ds:DigestValue>
                </ds:Reference>
            </ds:SignedInfo>
            <ds:SignatureValue>DCrm/mkLiVsD8dAc4puY/L3GR1bxtDBn6+sTifLgxDGokFbS4PShjA3Ak6mTW1dM48TwXi1oB9Pz++iOP4w6ZVeBj9bWIPJaCATjWn26xBlt3GHaPjiOpUdvG5YwwqCMUlQ1+M0RhJDlkChfZbjPIKXibcP8TBIsj2sekr5sQSI=</ds:SignatureValue>
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>MIICmzCCAgSgAwIBAgIGAT1+4eJ9MA0GCSqGSIb3DQEBBQUAMIGQMQswCQYDVQQGEwJVUzETMBEG
A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU
MBIGA1UECwwLU1NPUHJvdmlkZXIxETAPBgNVBAMMCHdhdGNoZG94MRwwGgYJKoZIhvcNAQkBFg1p
bmZvQG9rdGEuY29tMB4XDTEzMDMxODE5MDE0NVoXDTQzMDMxODE5MDI0NVowgZAxCzAJBgNVBAYT
AlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQK
DARPa3RhMRQwEgYDVQQLDAtTU09Qcm92aWRlcjERMA8GA1UEAwwId2F0Y2hkb3gxHDAaBgkqhkiG
9w0BCQEWDWluZm9Ab2t0YS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL/raSnE0EXQ
mPgkSwyv8HIDPpmvU6prdySiWJSB3YztIC29VuneZbT0dFAOjAy6e/3NN7HjvBQU83YjhgBA43+U
f/7kwC2V8e5qi92J/pTrAWPB/UmTbCEVoCkR4BxSXr4bJ3dhk6eIPDGgOiuWjNCMTXoYX+aS1tsA
JDx0bXf5AgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAfiBOI+/mpP52Qsg6Ea1jVN/mGm4snvKl6Nlh
5sYGhGw5zXBVDU4pI9ulm/8QZsCAlYZXltZ+eif7CRzy2VZvDVMGH3g69AD2xHveYr8UNYSjnLyB
ZPpVJVOysH7UgtBqNcHm0l00g4uUV2d52WcDiz85q/KjTBB9OjRdGVhkcow=</ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </ds:Signature>
        <saml2:Subject xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
            <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">OhadR@watchdox.com</saml2:NameID>
            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData InResponseTo="a32a5d9jfge33c9b46gdaddid8gd41b"
                                               NotOnOrAfter="2013-04-18T08:56:49.819Z"
                                               Recipient="http://srv101.watchdox.net/spring-security-saml2-sample/saml/SSO/alias/defaultAlias"
                                               />
            </saml2:SubjectConfirmation>
        </saml2:Subject>
        <saml2:Conditions NotBefore="2013-04-18T08:46:49.819Z"
                          NotOnOrAfter="2013-04-18T08:56:49.819Z"
                          xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                          >
            <saml2:AudienceRestriction>
                <saml2:Audience>com.watchdox.ohad</saml2:Audience>
            </saml2:AudienceRestriction>
        </saml2:Conditions>
        <saml2:AuthnStatement AuthnInstant="2013-04-18T08:51:49.819Z"
                              SessionIndex="a32a5d9jfge33c9b46gdaddid8gd41b"
                              xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                              >
            <saml2:AuthnContext>
                <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
            </saml2:AuthnContext>
        </saml2:AuthnStatement>
    </saml2:Assertion>
</saml2p:Response>

感谢您的任何回答!

最佳答案

如果它可能对将来的某人有所帮助-我现在就可以使用了!!

我将所有 3 个 URL 设置为同一个(正如您一周前建议的那样):
https://srv101.watchdox.net:443/spring-security-saml2-sample/saml/SSO/alias/defaultAlias

那么有什么区别，为什么现在有效？因为到目前为止，我输入的 URL 是 http 而不是 https(并且没有 443):
http://srv101.watchdox.net/spring-security-saml2-sample/saml/SSO/alias/defaultAlias

关于spring-security - 配置 saml-sample (SP) 以与 Okta (IdP) 一起使用，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/15997221/

25 4 0
文章推荐： Neo4j 匹配多个关系
文章推荐： javascript - 将 Threejs 透视相机转换为正交相机需要什么
文章推荐： python - 中和不可见的 ASCII 字符以打印 ASCII 表
文章推荐： javascript - 从 DOM 中删除组件
行者123
个人简介

我是一名优秀的程序员,十分优秀！

滴滴打车优惠券免费领取
滴滴打车优惠券
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com