saml - SAML 工件的用途是什么？

Question

我看过一堆关于如何通过重定向在身份提供商 (IdP)、服务提供商 (SP) 和浏览器之间传递的流程图。然而，现在对我来说似乎没有必要，所以我知道我错过了一些东西。

有人可以向我提供一个使用案例，其中与不使用 SAML 工件相比，需要(或非常有用)SAML 工件吗？

谢谢。

Answer 1

通常，工件绑定(bind)的目的是减少通过浏览器本身的 SAML 消息流。这可能是由于浏览器限制(浏览器对查询字符串/POST 有效负载大小有限制)或不支持 JavaScript(对于自动提交的表单)，甚至是为了改进 SAML 消息传输方式的安全模型。通过使用工件，通过 SAML 断言/属性语句携带的敏感数据不会通过浏览器传递，因此可以对最终用户或您的站点与最终用户之间的攻击者隐藏这些数据。这些 secret 数据只能通过反向 channel 查找在站点之间直接解析。

SAML 2.0 Bindings specs 第 3.6.2 节总结得最好:

The HTTP Artifact binding is intended for cases in which the SAML requester and responder need to communicate using an HTTP user agent as an intermediary, but the intermediary's limitations preclude or discourage the transmission of an entire message (or message exchange) through it. This may be for technical reasons or because of a reluctance to expose the message content to the intermediary (and if the use of encryption is not practical). Note that because of the need to subsequently resolve the artifact using another synchronous binding, such as SOAP, a direct communication path must exist between the SAML message sender and recipient in the reverse direction of the artifact's transmission (the receiver of the message and artifact must be able to send a request back to the artifact issuer). The artifact issuer must also maintain state while the artifact is pending, which has implications for load-balanced environments.