saml-2.0 - 如何生成由目的地指定的 SAML2Response

Question

我对 SAML 很陌生，在这一点上很困惑。我正在使用 Kentor 生成 Saml2Response，但它看起来不像我的依赖方所期望的那样。他们专门寻找要嵌入到响应中的证书。

我需要生成这个。

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" ID="_09f6a725ecf844128a5f7ef8cc1e7620"
IssueInstant="2013-12-11T03:52:21.770Z" Version="2.0" xmlns:xs="http://www.w3.org/2001/XMLSchema">
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" />
            <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" />
            <ds:Reference URI="#_09f6a725ecf844128a5f7ef8cc1e7620" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <ds:Transforms xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                    <ds:Transform
                    Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" />
                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                        <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="xs" />
                    </ds:Transform>
                </ds:Transforms>
                <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" />
                <ds:DigestValue xmlns:ds="http://www.w3.org/2000/09/xmldsig#">DATA_REMOVED</ds:DigestValue>
            </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue xmlns:ds="http://www.w3.org/2000/09/xmldsig#">DATA_REMOVED</ds:SignatureValue>
        <ds:KeyInfo>
            <ds:KeyName>[removed]</ds:KeyName>
        </ds:KeyInfo>
    </ds:Signature>
    <saml2p:Status>
        <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
    </saml2p:Status>
    <saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_cadd3488f62c6d3b9933fdb56d9e8ddc"
    IssueInstant="2013-12-11T03:52:21.770Z" Version="2.0" xmlns:xs="http://www.w3.org/2001/XMLSchema">
        <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">[removed]</saml2:Issuer>
        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
            <ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" />
                <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" />
                <ds:Reference URI="#_cadd3488f62c6d3b9933fdb56d9e8ddc" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                    <ds:Transforms xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                        <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" />
                        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                            <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="xs" />
                        </ds:Transform>
                    </ds:Transforms>
                    <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" />
                    <ds:DigestValue xmlns:ds="http://www.w3.org/2000/09/xmldsig#">DATA_REMOVED</ds:DigestValue>
                </ds:Reference>
            </ds:SignedInfo>
            <ds:SignatureValue xmlns:ds="http://www.w3.org/2000/09/xmldsig#">DATA_REMOVED</ds:SignatureValue>
            <ds:KeyInfo>
                <ds:KeyName>CN=, O=, C=US</ds:KeyName>
            </ds:KeyInfo>
        </ds:Signature>
        <saml2:Subject xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
            <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" NameQualifier="com.sms">0500555</saml2:NameID>
            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData NotBefore="2013-12-11T03:47:21.770Z" NotOnOrAfter="2013-12-11T03:57:21.770Z" />
            </saml2:SubjectConfirmation>
        </saml2:Subject>
        <saml2:Conditions NotBefore="2013-12-11T03:52:21.770Z" NotOnOrAfter="2013-12-11T03:57:21.770Z"
    xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" />
        <saml2:AuthnStatement AuthnInstant="2013-12-11T03:52:21.770Z" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
            <saml2:AuthnContext>
                <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef>
            </saml2:AuthnContext>
        </saml2:AuthnStatement>
        <saml2:AttributeStatement xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
            <saml2:Attribute Name="AppData" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
                <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">A_Party_PI.Person.FirstName =John& A_Party_PI.Person.LastName =Smith</saml2:AttributeValue>
            </saml2:Attribute>
            </saml2:Attribute>
        </saml2:AttributeStatement>
    </saml2:Assertion>
</saml2p:Response>

我从肯特得到的是：

<?xml version="1.0"?>
<saml2p:Response
    Destination="https://[destinationUrl]"
    ID="ide5470d1f5a9a48d1822f71ea5a5363f2"
    IssueInstant="2015-05-28T13:35:44Z"
    Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
        ritterim.com
    </saml2:Issuer>
    <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
        <SignedInfo>
            <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
            <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
            <Reference URI="#ide5470d1f5a9a48d1822f71ea5a5363f2">
                <Transforms>
                    <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                    <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                </Transforms>
                <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                <DigestValue>7YmTpqZR6Ba4/eDrEqQt7BGit0A=</DigestValue>
            </Reference>
        </SignedInfo>
        <SignatureValue>
        </SignatureValue>
    </Signature>
    <saml2p:Status>
        <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </saml2p:Status>
    <saml2:Assertion ID="_77b39d8e-bcc4-48c2-b6c7-fe6e87414461"
        IssueInstant="2015-05-28T13:35:44Z" Version="2.0"
        xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
        <saml2:Issuer>ritterim.com</saml2:Issuer>
        <saml2:Subject>
            <saml2:NameID>0500555</saml2:NameID>
            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"/>
        </saml2:Subject>
        <saml2:Conditions NotOnOrAfter="2015-05-28T13:37:44Z"/>
        <saml2:AttributeStatement>
            <saml2:Attribute Name="AppData">
                <saml2:AttributeValue>A_Party_PI.Person.FirstName =John&amp; A_Party_PI.Person.LastName =Smith</saml2:AttributeValue>
            </saml2:Attribute>
        </saml2:AttributeStatement>
    </saml2:Assertion>
</saml2p:Response>

任何帮助将不胜感激，因为我什至不确定我是否在正确的舞台上。

score 0 · Accepted Answer

我将通过评论回复中的差异来回答。

xml 声明中没有编码。应该没关系吧
添加了可选的颁发者。
我假设您已经从 AuthServices 响应中删除了 SignatureValue。
AuthServices 当前在签名中不包含 KeyInfo（它是可选的）
AuthServices 不签署断言，只签署响应。
XML 命名空间声明由 AuthServices 放在一个地方，并且不会重复。
主题 NameId 上没有格式（它是可选的）
主题 NameId 上没有 NameQualifier（它是可选的）
属性上没有 NameFormat（它是可选的）
AttributeValue 上没有 xml 类型 (xsi:string)（它是可选的）

基本上，Kentor.AuthServices 遗漏了一堆可选的东西，但除此之外消息是等价的。

您必须提供有关导致问题的原因的更多详细信息才能获得帮助。

saml-2.0 - 如何生成由目的​​地指定的 SAML2Response

1 回答 1

Related

Reference

saml-2.0 - 如何生成由目的地指定的 SAML2Response