java - 使用 OpenSaml 将 SAMLRequest 解析为 AuthnRequest，Unmarshaller 为 NULL

Question

我想将在 HttpServletRequest 中获得的 SAMLRequest 解析为 AuthnRequest 对象，以便获得它的颁发者和其他属性。

使用 OpenSaml 版本

<dependency>
            <groupId>org.opensaml</groupId>
            <artifactId>opensaml-core</artifactId>
            <version>3.1.0</version>
        </dependency>

        private String receiveResponse(@RequestParam(name = "SAMLRequest") final String samlRequest, final Model model,
        final HttpServletRequest request, final HttpServletResponse response){

        final String encodedSAMLRequest = request.getParameter(EidasConstants.SAML_REQUEST);

        byte[] samlToken = EidasStringUtil.decodeBytesFromBase64(encodedSAMLRequest);
        //equal to base64.decode

        ByteArrayInputStream stream = new ByteArrayInputStream(samlToken);        
        DefaultBootstrap.bootstrap();

        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
        factory.setNamespaceAware(true);
        DocumentBuilder docBuilder = factory.newDocumentBuilder();
        Document samlDocument = docBuilder.parse(stream);
        Element samlElem = samlDocument.getDocumentElement();

        UnmarshallerFactory unmarshallerFactory = Configuration.getUnmarshallerFactory();
        Unmarshaller unmarshaller = unmarshallerFactory.getUnmarshaller(samlElem);
        Object requestXmlObj = unmarshaller.unmarshall(samlElem);
        AuthnRequest authRequest = (AuthnRequest) requestXmlObj;
        }

我的元素是这个

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" AssertionConsumerServiceURL=
"https://amis-dev.ulisboa.pt/nidp/saml2/spassertion_consumer" Consent="urn:oasis:names:tc:SAML:2.0:consent:unavailable" Destination="http://10.110.58.
100:8080/RequestReceiver" ForceAuthn="false" ID="iddVeu9K-BZRNMsife2aSbJ_SZUt8" IsPassive="false" IssueInstant="2019-08-28T14:33:33Z" ProtocolBinding=
"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">
<saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">ULisboa</saml:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<CanonicalizationMethod xmlns="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="#iddVeu9K-BZRNMsife2aSbJ_SZUt8">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<DigestValue xmlns="http://www.w3.org/2000/09/xmldsig#">DB9eyPJL2El5nj01uowV7AtskOuiqW+482q29Ox9nU4=</DigestValue>
</ds:Reference>
</ds:SignedInfo>
<SignatureValue xmlns="http://www.w3.org/2000/09/xmldsig#">
VgNtmtSJEHSY2dgHKNJbSDKocDZfMyIrxkjGkBLgWAKMRwC601C0OY9t1w0C5ZT+79pjbzVgHJ47
OxNrXqW0ayVuSQiFdw8pPAsNRsCXRkgPWUQf2so5XgvIAUZOd491sehRKzz6LNF9FhJWuNLXuNIl
joKu9Sn5G7OZXaynSFQ93Rph4uMYp/esu/tlO8d1toPpZS0phwlAEtQvoVgWRQBNyXdgzyulrorJ
Ogm3zP5U6F41wYhO9mb29rcEIuTUQUrOaNHNJ+f1BlJuffs4SCB2toKXKsuxwWmiDyQ0nMOr9RvA
WUy9nUmNhljuRwQoB1Wt31AvW4jX9yeZsi0XqA==
</SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
MIIGvTCCBaWgAwIBAgIQDwGHVYp6wgGfBYR9UdgiRDANBgkqhkiG9w0BAQsFADBkMQswCQYDVQQG
EwJOTDEWMBQGA1UECBMNTm9vcmQtSG9sbGFuZDESMBAGA1UEBxMJQW1zdGVyZGFtMQ8wDQYDVQQK
EwZURVJFTkExGDAWBgNVBAMTD1RFUkVOQSBTU0wgQ0EgMzAeFw0xOTA2MTgwMDAwMDBaFw0yMTA2
MjIxMjAwMDBaMHgxCzAJBgNVBAYTAlBUMQ8wDQYDVQQHEwZMaXNib2ExHzAdBgNVBAoTFlVuaXZl
cnNpZGFkZSBkZSBMaXNib2ExETAPBgNVBAsTCFJlaXRvcmlhMSQwIgYDVQQDExtkZXYuc2lnbmlu
Zy5hbWNzLnVsaXNib2EucHQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCs2/RNHEvo
n605sQSzDehbLwXCS3bMoEN9ynC82oZsHJiv4eg+RNTd5K8zcUtfFx0e6yA3TjaSm9NomqyPvJLS
PS9wnxDwx1fNwlg+frPciLvy4u/pteSKcveKlyRbR+h9GDc38ZpRnTf0HO4IWU4AQVLQKBMBA6RE
2D0MyoFlQjdmhNQrjI7h4jTTcB1w3cWZSmjZNvuIvOS2wQRP1GyxhHsul/CqRtxPX5YVHiinHzAe
3pvHJsSaaQ+S9dyAYe0njGZlx7UpoUXHaabkhOqLILoxy0gcUiD7WGVdXZ1dwu3EMjAqlgpD93fx
JHBfNG+1cj20U/iv6iuvX75ebkKNAgMBAAGjggNVMIIDUTAfBgNVHSMEGDAWgBRn/YggFCeYxwnS
JRm76VERY3VQYjAdBgNVHQ4EFgQUxFw+Ct+xZGUbOMc7M8VTzAy3kEYwJgYDVR0RBB8wHYIbZGV2
LnNpZ25pbmcuYW1jcy51bGlzYm9hLnB0MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEF
BQcDAQYIKwYBBQUHAwIwawYDVR0fBGQwYjAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29t
L1RFUkVOQVNTTENBMy5jcmwwL6AtoCuGKWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9URVJFTkFT
U0xDQTMuY3JsMEwGA1UdIARFMEMwNwYJYIZIAYb9bAEBMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8v
d3d3LmRpZ2ljZXJ0LmNvbS9DUFMwCAYGZ4EMAQICMG4GCCsGAQUFBwEBBGIwYDAkBggrBgEFBQcw
AYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMDgGCCsGAQUFBzAChixodHRwOi8vY2FjZXJ0cy5k
aWdpY2VydC5jb20vVEVSRU5BU1NMQ0EzLmNydDAMBgNVHRMBAf8EAjAAMIIBfQYKKwYBBAHWeQIE
AgSCAW0EggFpAWcAdgC72d+8H4pxtZOUI5eqkntHOFeVCqtS6BqQlmQ2jh7RhQAAAWtp8n8BAAAE
AwBHMEUCIQCOSYDJAK9q9A+8ClauNZsuqcbMwCbvyKMFMf5xdXCN9QIgSKHaQo7OWu2Of2Fs+mv6
SIEeTcjKz3DwMyogBt1gU64AdgCHdb/nWXz4jEOZX73zbv9WjUdWNv9KtWDBtOr/XqCDDwAAAWtp
8n9LAAAEAwBHMEUCIE41+CeuD3GJuFRjlcAdmJD4ZD15Sd9fdvDGpurOlHC6AiEAu6uqPFtIOWg2
MCpWhLAUotR4LRwYT4pzsRvsp2qBb+IAdQBElGUusO7Or8RAB9io/ijA2uaCvtjLMbU/0zOWtbaB
qAAAAWtp8n59AAAEAwBGMEQCIBb0GzYmGqmDlVJQZyIxXmhzdXGVTgXgAomsULtuOzU2AiArb71G
dALsrTlrNdggJo+AmF1y6gV5vp0z5XcyFOfxnzANBgkqhkiG9w0BAQsFAAOCAQEAOgsfy6lu/k7r
CrkS6OQq1kbMh02iRJeO37k2qJCK9dRmk+P0prteopLy8GESWkVIDnoAmTpTnIbjr9fy/NmCplCm
D69w56GI+fPVdUpYpTH5wpBoEutDEz53XfCBwb50Ujwg2+LQy1HrEH2B990Sm78UcNahyHfVVAtk
kx9wLpkyk0FZwgabjrFkZCTsEmJvvbAfHG4jAoMElE3aUuO2Oxp4kwgn1v871Xjmt7iOzSMAYuWC
ZaoJN8S2ZDrsjhHOSzOGKMb9aoxwIm3w8LnikWCtv2lBWnXSCV2HaQ5UhjH+pjt5yrBgsDWPOtQF
6dJlIODiWR35BmBaAQOkF7Aapg==
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
</samlp:AuthnRequest>

用于

Unmarshaller unmarshaller = unmarshallerFactory.getUnmarshaller(samlElem);

创建解码器，但解码器返回 NULL。

得到的错误信息是

java.lang.NullPointerException: null
        at pt.ulisboa.ssobroker.controller.RequestReceiverController.receiveResponse(RequestReceiverController.java:100) ~[classes/:na]
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_181]
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_181]
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_181]
        at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_181]
        at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:190) ~[spring-web-5.1.8.RELEASE.jar:5.1.
8.RELEASE]
        at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:138) ~[spring-web-5.1.8.RELEASE.
jar:5.1.8.RELEASE]
        at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:104)
 ~[spring-webmvc-5.1.8.RELEASE.jar:5.1.8.RELEASE]
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:89
2) ~[spring-webmvc-5.1.8.RELEASE.jar:5.1.8.RELEASE]
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:797) ~[
spring-webmvc-5.1.8.RELEASE.jar:5.1.8.RELEASE]
        at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) ~[spring-webmvc-5.1.8.
RELEASE.jar:5.1.8.RELEASE]
        at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1039) ~[spring-webmvc-5.1.8.RELEASE.jar:5.1.8.RELEASE]
        at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:942) ~[spring-webmvc-5.1.8.RELEASE.jar:5.1.8.RELEASE]
        at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1005) ~[spring-webmvc-5.1.8.RELEASE.jar:5.1.8.RELEASE
]
        at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:908) ~[spring-webmvc-5.1.8.RELEASE.jar:5.1.8.RELEASE]

所以最后我只想获取 AuthnRequest 对象以便我可以使用它，但是因为 unmarshaller 是 NULL 我无法获取它，我已经测试了所有其他步骤直到那里似乎正常，我只是不知道为什么解码器返回 NULL。

我尝试了一种使用来自 shibboleth 的 parsePool 的方法，但无济于事。

AuthnRequest authRequest = (AuthnRequest) XMLObjectSupport.unmarshallFromInputStream(parserPool, stream);

但我无法让 shibboleth parserPool 正确初始化

Answer 1

我认为目前您同时拥有 OpenSAML2 和 OpenSAML3 依赖项。因此，首先通过使用 mvn dependency:tree 搜索它们来删除 OpenSAML2 依赖项，然后排除 OpenSAML2 依赖项。之后，除了问题中提到的依赖项之外，您还需要添加:

<dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml-saml-impl</artifactId>
        <version>3.1.0</version>
</dependency>

然后修改方法如下:

private String receiveResponse(@RequestParam(name = "SAMLRequest") final String samlRequest, final Model model,
    final HttpServletRequest request, final HttpServletResponse response){

    InitializationService.initialize();

    final String encodedSAMLRequest = request.getParameter(EidasConstants.SAML_REQUEST);

    byte[] samlToken = EidasStringUtil.decodeBytesFromBase64(encodedSAMLRequest);
    //equal to base64.decode

    ByteArrayInputStream stream = new ByteArrayInputStream(samlToken);        
    DefaultBootstrap.bootstrap();

    DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
    factory.setNamespaceAware(true);
    DocumentBuilder docBuilder = factory.newDocumentBuilder();
    Document samlDocument = docBuilder.parse(stream);
    Element samlElem = samlDocument.getDocumentElement();

    UnmarshallerFactory unmarshallerFactory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();
    Unmarshaller unmarshaller = unmarshallerFactory.getUnmarshaller(samlElem);
    Object requestXmlObj = unmarshaller.unmarshall(samlElem);
    AuthnRequest authRequest = (AuthnRequest) requestXmlObj;
}

然后尝试一下。