shibboleth - Web 登录服务 - 拒绝访问(Shibboleth IdP 3)

Question

我已将 Shibboleth IdP 3 配置为针对 LDAP (AD) 进行身份验证。

当我访问以下 URL 时

https://FDQN-of-the-IdP/idp/status

我看到以下页面。


来自 IdP 节目的日志

2015-11-24 10:39:43,394 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2015-11-24 10:39:43,394 - INFO [org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:108] - Message Handler:  No metadata returned for http://google.com/enterprise/gsa/xxxx in role {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol
2015-11-24 10:39:43,394 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler' on INBOUND message context
2015-11-24 10:39:43,394 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2015-11-24 10:39:43,394 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer:132] - Profile Action InitializeRelyingPartyContextFromSAMLPeer: Attaching RelyingPartyContext based on SAML peer http://google.com/enterprise/gsa/xxxxx
2015-11-24 10:39:43,394 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:284] - Resolving relying party configuration
2015-11-24 10:39:43,394 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:290] - Profile request is unverified, returning configuration shibboleth.UnverifiedRelyingParty
2015-11-24 10:39:43,394 - DEBUG [net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:136] - Profile Action SelectRelyingPartyConfiguration: Found relying party configuration shibboleth.UnverifiedRelyingParty for request
2015-11-24 10:39:43,394 - DEBUG [net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:220] - Profile Action PopulateAuditContext: Adding 1 value for field 'IDP'
2015-11-24 10:39:43,394 - DEBUG [net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:220] - Profile Action PopulateAuditContext: Adding 1 value for field 'SP'
2015-11-24 10:39:43,394 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:111] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/browser is not available for relying party configuration shibboleth.UnverifiedRelyingParty
2015-11-24 10:43:17,231 - INFO [net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy:327] - Default key version has not changed, still secret1

为什么我无法访问状态页面？

Answer 1

确保您已正确设置 config\access-control.xml 配置。默认访问控制是基于 IP 的:

    <entry key="AccessByIPAddress">
        <bean parent="shibboleth.IPRangeAccessControl"
            p:allowedRanges="#{ {'127.0.0.1/32', '192.0.0.0/32','::1/128', '192.168.120.148/32'} }" />
    </entry>

确保您允许 IP 访问 IDP，它也必须采用 CIDR 格式