php - SimpleSamlPhp 作为 SP 重定向不正确

Question

我有一个作为服务提供者的 SimpleSamlPHP 实现，因此工作流程如下:

IdP 向我的 ACS URL 发送断言:

/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp

但随后看起来他进行了身份验证并被重定向到

/simplesaml/module.php/saml/sp/saml2-acs.php

这会引发错误，因为没有指定 authsource(/default-sp 部分):

SimpleSAML_Error_Error: UNHANDLEDEXCEPTION
Backtrace:
0 *\simplesamlphp\www\module.php:180 (N/A)
Caused by: SimpleSAML_Error_Exception: No authentication source with id false found.
    Backtrace:
    2 *\simplesamlphp\lib\SimpleSAML\Auth\Source.php:242 (SimpleSAML_Auth_Source::getById)
    1 *\simplesamlphp\modules\saml\www\sp\saml2-acs.php:8 (require)
    0 *\simplesamlphp\www\module.php:135 (N/A)

但是，它也有一组 PHP 错误输出到页面:

Warning: array_key_exists(): The first argument should be either a string or an integer in *\simplesamlphp\lib\SimpleSAML\Configuration.php on line 314 
Warning: Cannot modify header information - headers already sent by (output started at *\simplesamlphp\lib\SimpleSAML\Configuration.php:314) in *\simplesamlphp\lib\SimpleSAML\Error\Error.php on line 191 
Warning: Cannot modify header information - headers already sent by (output started at *\simplesamlphp\lib\SimpleSAML\Configuration.php:314) in *\simplesamlphp\templates\includes\header.php on line 40

(我已经取出目录路径并替换为 * - 这不是正常的)

我无法确定这是 SimpleSamlPHP 的错误还是(更有可能)设置不正确。我的 authsources 和元数据如下:

saml20-idp-remote.php:

$metadata['https://app.onelogin.com/saml/metadata/391645'] = array(
    'name' => 'FSSO',
    'SingleSignOnService' => 'https://app.onelogin.com/trust/saml2/http-post/sso/391645',
    'AssertionConsumerservice' => 'https://www.fbjni.com/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp',
    'SingleLogoutService' => 'https://www.fbjni.com/simplesaml/module.php/saml/sp/saml2-logout.php/default-sp',
    'certData'          => '[rawCertificateData]'
);

authsources.php:

'default-sp' => array(
    'saml:SP',
    'RelayState' => 'https://www.fbjni.com/',
    'entityID' => 'https://app.onelogin.com/saml/metadata/391645',
),

Answer 1

您的 IdP 元数据可能存在一些问题。 SimpleSAMLphp 包含一个元数据解析器，它负责将 IdP 配置详细信息转换为 SimpleSAMLphp 所需的格式。此处的 SimpleSAMLphp 文档中简要提到了此功能:https://simplesamlphp.org/docs/1.8/simplesamlphp-sp#section_2

根据上面的示例，您应该能够访问 https://www.fbjni.com/simplesaml/admin/metadata-converter.php 处的元数据解析器。 .

在上面的特定示例中，从 https://app.onelogin.com/saml/metadata/391645 下载 OneLogin 元数据。并将此 XML 复制到 SimpleSAMLphp 安装中的元数据解析器中。

转换元数据后，用元数据解析器的输出替换上面现有的 IdP 配置，它应该看起来更像这样:

$metadata['https://app.onelogin.com/saml/metadata/391645'] = array (
  'entityid' => 'https://app.onelogin.com/saml/metadata/391645',
  'contacts' => 
  array (
    0 => 
    array (
      'contactType' => 'technical',
      'surName' => 'Support',
      'emailAddress' => 
      array (
        0 => 'support@onelogin.com',
      ),
    ),
  ),
  'metadata-set' => 'saml20-idp-remote',
  'SingleSignOnService' => 
  array (
    0 => 
    array (
      'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
      'Location' => 'https://app.onelogin.com/trust/saml2/http-post/sso/391645',
    ),
    1 => 
    array (
      'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
      'Location' => 'https://app.onelogin.com/trust/saml2/http-post/sso/391645',
    ),
    2 => 
    array (
      'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:SOAP',
      'Location' => 'https://app.onelogin.com/trust/saml2/soap/sso/391645',
    ),
  ),
  'SingleLogoutService' => 
  array (
  ),
  'ArtifactResolutionService' => 
  array (
  ),
  'keys' => 
  array (
    0 => 
    array (
      'encryption' => false,
      'signing' => true,
      'type' => 'X509Certificate',
      'X509Certificate' => 'MIIEJjCCAw6gAwIBAgIUHyryf8tYCgBMvr2nihtEA3NFrQEwDQYJKoZIhvcNAQEF
BQAwXTELMAkGA1UEBhMCVVMxFjAUBgNVBAoMDUZhY2Vib29rIFRlc3QxFTATBgNV
BAsMDE9uZUxvZ2luIElkUDEfMB0GA1UEAwwWT25lTG9naW4gQWNjb3VudCA0MDA1
ODAeFw0xNDAzMjYwMzA2NDNaFw0xOTAzMjcwMzA2NDNaMF0xCzAJBgNVBAYTAlVT
MRYwFAYDVQQKDA1GYWNlYm9vayBUZXN0MRUwEwYDVQQLDAxPbmVMb2dpbiBJZFAx
HzAdBgNVBAMMFk9uZUxvZ2luIEFjY291bnQgNDAwNTgwggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQDjmCU+PbTPgsjgffG2cqTBzVTYOx80L07ZO2tGaqry
oCXJctP9fEcFleamose/+mg052wxStd84FpHwa2JC7sbHNeMIaBbA3b1XzFgNVJy
D2KjJK17ftYTm8EprtDPuCiMyHI3P2XGuz+i9BonxhUodgITa9FELqKAJU1GKtsJ
r4saGVlpYZgU9InYlGNohdkFfkbPSRiUeQoRhKYtYmM74maL7aGdXvSyXmUaa+n6
rl6MTMUCJj8tfs2CwqT1Ktc1wZTBRWUXcxi/02IP9AVXghhLcE1ES1tFV58FsvNN
Dtpigg9PFnRwAoC0HSMVEYh3VBx+TROqyGmM74i1yJGvAgMBAAGjgd0wgdowDAYD
VR0TAQH/BAIwADAdBgNVHQ4EFgQU11p7PgInyRe7dHHUQMrbBfka8+cwgZoGA1Ud
IwSBkjCBj4AU11p7PgInyRe7dHHUQMrbBfka8+ehYaRfMF0xCzAJBgNVBAYTAlVT
MRYwFAYDVQQKDA1GYWNlYm9vayBUZXN0MRUwEwYDVQQLDAxPbmVMb2dpbiBJZFAx
HzAdBgNVBAMMFk9uZUxvZ2luIEFjY291bnQgNDAwNTiCFB8q8n/LWAoATL69p4ob
RANzRa0BMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQUFAAOCAQEAv9Cwtv6V
ov6heh5b/u+hsFk9Lhva/jzOgbYAblWxDTgsvcehbYeZSO3XTqq5I3qx9XCqet4a
FdUetFMPk/cpcl9GahHhagvScn+ClbHVnrakRt/1/oDcrxi+6l+GT7yzg7MPoj6C
AIjmVdPhbWRiU3on6PkG95pfDq/hasCTHS3kVUJlv+Ge2rdiiIyVJmlak24UQVuN
2DznvY5jlUOIXXtCTLttu7YY5z9V0pSa0MdWDL3/mokGIjydR2DdHfkgyk2syjny
4+9ohie+oLKz1rv9OcAv+90WAYaltDoTSMYSG9W2rjeDh2NHYFuWxXOi08FPZfXo
DFLPLA0yYeSkFA==',
    ),
  ),
);

此外，您应该对 authsources.php 配置进行一些更改。您的 SP 的“entityID”通常是您的应用程序的 URL，而不是您选择的 IdP 的标识符。您可以为 SP 指定默认 IdP，如下所示:

'default-sp' => array(
    'saml:SP',
    'entityID' => 'https://www.fbjni.com/',
    'RelayState' => 'https://www.fbjni.com/',
    'idp' => 'https://app.onelogin.com/saml/metadata/391645'
),