我正在尝试将 Google 设置为 SP，将我自己的数据库设置为 IDP。我已经使用我的登录和注销 URL 配置了我的 GSuite 帐户，谷歌正在完美地重定向到它们。但是在谷歌发出 SAML 请求后，我尝试生成 SAML 响应，我得到G Suite - 由于无法验证登录凭据，因此无法访问此帐户。
以下是我的 SAML 响应 XML：
<?xml version="1.0"?>
<!DOCTYPE samlp:Response [
<!ATTLIST samlp:Response ID ID #IMPLIED>
]>
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="n7dff0678252c667b24cae2be1925746166d0906c" Version="2.0" IssueInstant="2017-01-12T12:05:23Z" Destination="https://www.google.com/a/demo.mediaagility.com/acs"><saml:Issuer>google.com/a/demo.mediaagility.com</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#n7dff0678252c667b24cae2be1925746166d0906c"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>bcUzuWbYSccmvCXN25mXaW7u1qw=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>6L7UmVK/76MeVupEUKSLySrLEntcDrI0CPad3TQEN3D7BDKgoRpfWXWiQElsk64i
H0c1iCfrDEApoAFe17iORowmJlghumTJzzCXfPhcvpecj2UmikivULyM87eKNVGa
kEG4ZXS/1OqWwZ3HpVtHK3VPYPQY1FnvAnAEeZNj3zRgv3hyuAHXaUcAEHVYbLGa
uvkbQrOSlVafHMPEj++go3AS6B6QFxonVGYbf5FE+txkKocyudLBf94IJl6Gd3o0
VCMj7UewcXm1MweXOZyh+M6AXTt125QQGZFPJWiTMDTjFWIKzGXdh/Rau/B1S1KU
BG4VbE0C8goQfGwbKhQ3jg==</ds:SignatureValue><ds:KeyInfo><ds:X509Data>
<ds:X509Certificate>MIIEBzCCAu+gAwIBAgIJANPE0ekUwoLyMA0GCSqGSIb3DQEBBQUAMIGZMQswCQYD
VQQGEwJJTjERMA8GA1UECAwISGFyaXlhbmExEDAOBgNVBAcMB2d1cmdhb24xFTAT
BgNVBAoMDE1lZGlhYWdpbGl0eTELMAkGA1UECwwCSVQxFTATBgNVBAMMDERlZXBh
ayBWZXJtYTEqMCgGCSqGSIb3DQEJARYbYWRtaW5AZGVtby5tZWRpYWFnaWxpdHku
Y29tMB4XDTE3MDExMDEzNDEyNVoXDTE3MDIwOTEzNDEyNVowgZkxCzAJBgNVBAYT
AklOMREwDwYDVQQIDAhIYXJpeWFuYTEQMA4GA1UEBwwHZ3VyZ2FvbjEVMBMGA1UE
CgwMTWVkaWFhZ2lsaXR5MQswCQYDVQQLDAJJVDEVMBMGA1UEAwwMRGVlcGFrIFZl
cm1hMSowKAYJKoZIhvcNAQkBFhthZG1pbkBkZW1vLm1lZGlhYWdpbGl0eS5jb20w
ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQD+vxDJs6k2B2pcALaLly/c
bo/hiyEWZe11str5MuA5/HvZkv7lRtkhSTe3kRX3a+rp73v4adWrJr2milgAtaqS
VUo8lwYoIiqKj4Ge74iJxvCsdB3GlUU25jbbPLOUKdTsNaw1lPvk95af7EODulvQ
6nygazb4q/OycuuFfl4+nqPZwPothOClC+q3QaiZaGBjo4UmC07xMrFtuv8itsNO
MtwBvWnvPTXLGZU/g/yoj+Y6r6b8k+4jkoS9SsU/BTTtBP380JR1KOi/wEJV5Mny
dumItPSPu9pl5SnJJq4DWVwFpYHYJDXK9161kjcIz+JGi7H3S7MymfnkN29pw/wF
AgMBAAGjUDBOMB0GA1UdDgQWBBSWTdppBx2wxiVdbB+EO/TpYJsbpTAfBgNVHSME
GDAWgBSWTdppBx2wxiVdbB+EO/TpYJsbpTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3
DQEBBQUAA4IBAQDWIV1TLM0pnNtEVeIUplYL8oq2jvSjvVUzNzN2TvXPBSr8GdAv
Awep/pJyeSARZb1bynkO6RGLPUgPB5/ISvS4I0HYT91TfO0iQWzY6ILGKb4CMQhc
x379pqesS6owd+zJ35H5/lnIC3jEIaWjq0/d8JoXIcehzkzIYzjt883KyD3EEe2Y
OoU7hK8eYJwKXNjk37HLfPZ9bmUec/s2Er6AFPp92KTR6wdspy0BvMnvdLmXtkh2
/yX9UMwyDcq4QW+f001i7H8nT3v7C4MqnCrHE2Y+a0XetS+5WIEXYHx7KBeYzTl4
CqkH0LFKuOBfEDBfMj+nGWyeG/vfh9MaELIW</ds:X509Certificate>
</ds:X509Data></ds:KeyInfo></ds:Signature><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><saml:Assertion Version="2.0" ID="gf860726b83c8386cdd3d89131223f535cb51f615" IssueInstant="2017-01-12T12:05:23Z"><saml:Issuer>google.com/a/demo.mediaagility.com</saml:Issuer><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:email">admin@demo.mediaagility.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData InResponseTo="nhchacfajpmpbahlbbdoneoncpicjheamlgooigp" Recipient="https://www.google.com/a/demo.mediaagility.com/acs" NotOnOrAfter="2017-01-13T12:05:23Z"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2017-01-12T12:05:23Z" NotOnOrAfter="2017-01-13T12:05:23Z"><saml:AudienceRestriction><saml:Audience>google.com/a/demo.mediaagility.com</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2017-01-12T12:05:23Z" SessionIndex="gf860726b83c8386cdd3d89131223f535cb51f615"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion></samlp:Response>
我使用 python-saml python 包来签署我的 saml 响应：-
from onelogin.saml2.utils import OneLogin_Saml2_Utils
bPath = os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))), "keys")
cert = open(os.path.join(bPath, "cert.pem")).read()
key = open(os.path.join(bPath, "private_key.pem")).read()
signedData = OneLogin_Saml2_Utils.add_sign(samlXML, key, cert)
return signedData
任何帮助将不胜感激。我正在使用 python 语言。
以下是我的 Google SSO 配置
