1

我正在想办法使用第三方身份提供者进行顶点 SSO 身份验证。在SAML SSO的帮助下，我几乎完成了

这是身份提供者提供的我的元数据文件

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="u2ecyBkedSUsxVldsmYW27kONOp" cacheDuration="PT1440M" entityID="ps.trivadis.com">
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="#u2ecyBkedSUsxVldsmYW27kONOp">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>Q0tFZzytRiz4POfzapmQCAOYMGdQ4s62D8U2K7YMP4Y=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
F+/8hUvaF+gqud3lt6Ua2BIPcrgdlMyMlghBwQ56yy0mcYv7fkxYlDys/8Ae7Lc6o05aGWesg0/m AeyJXZRwDOjuoeNPKvEK63J2xcPpJthN2XVyVdnfb5owAUuwSjysvMFLl8PQyN2Zoe6iOPXsPEJD PTQ7L2JRcM+WkgPGqxa/I8A4A+odK7BLSy4yVIzkrV3XD7NnQ0uiy7BbyFsPla+LGY08mwwAQhT9 Fe5Om4dWduckDP01JO8PJmdbELwkI5XmtQEsZoPbJsZ4AcjNJjX+5Uzm+CQep1BaxtU7xWisHrhh qd2JC76CJX5FMuyAnCaSqY5WHdBZ9CS0RaA5Fg==
</ds:SignatureValue>
</ds:Signature>
<md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" WantAuthnRequestsSigned="false">
<md:KeyDescriptor use="signing">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>
MIIC/DCCAeSgAwIBAgIGAW1jcutSMA0GCSqGSIb3DQEBCwUAMD8xCzAJBgNVBAYTAkNIMRQwEgYDVQQKEwtUcml2YWRpcyBBRzEaMBgGA1UEAxMRZnMtdGVzdC52ZXJ0dW0uY2gwHhcNMTkwOTI0MTMyNTM4WhcNMjkwOTIxMTMyNTM4WjA/MQswCQYDVQQGEwJDSDEUMBIGA1UEChMLVHJpdmFkaXMgQUcxGjAYBgNVBAMTEWZzLXRlc3QudmVydHVtLmNoMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiwEI+qomPi0q8KCh6dLvmdZTbbN/R2uGaUgLZ7AgC/zYpEo1yX6FOpkZi2FK8x55B04NSWAVyF6YxPS2365Bm9aiWXdBLhs6mJJ46SjmuhTEPKWGL2lX7mPDamD5RR7FgNzj6ZM6f7S0Rl2jBoYt8eonYqbD+BcPX2F8YDlUWQfEuAdet7U+IZuE96r885QJS3Fx4CZ1/+IUk9kbKg9BZTutaz30TxGYQ5yC0GGFylMT4YbUA9SRiHeyOZdIiV0c6IzMF50d2VbBd+zcJdfF4Vi0je+G+TdvObJ0B14SVPyXwjBWRXuWsaY9BLIiHJD+DHAafcWpBb4SJWk+QfIVWQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAZBV9Hlfc3YrY/uCMelb+P8wVbnJbhONkTZsI+775FT+mk1cGZMEyUoItcwZg3eFOKWtykpujCPYoqandCvDu0Me6BLDCtUTx+KZrbwJ/xJyKVqWay53hrkcJHGzAv1ZJ5GtIcPpQCH9EYDC6GcmFSYaiJcNHB+TKtgxjyXTvDzuU1v4qsLQQVC0qlKUbyErYvdv7doqn7MnIMTYafJDZwiPh6phXZTswjN47Fkj32Ekt0zOC2oX4uEPTBxk6zCGIIcLsr3Sbns8kbHRcMWRaGUo8wryCDM99HBuwU+QArAqYGEsgZ3sEmEmICeshM/I5jkUHIj/Y+FVgdJqHo35iy
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:NameIDFormat>
urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
</md:NameIDFormat>
<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://fs.trivadis.com/idp/SSO.saml2"/>
<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://fs.trivadis.com/idp/SSO.saml2"/>
<saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="mail" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
<saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="givenName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
<saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="sn" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
<saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="memberOf" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
<saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="userPrincipalName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
<saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="SAML_NAME_FORMAT" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"/>
</md:IDPSSODescriptor>
<md:ContactPerson contactType="administrative"/>
</md:EntityDescriptor>

我已经按照上面链接中提到的简单步骤进行操作。但我仍然没有成功或通过第三方身份提供者实际登录到顶点。如果您想了解有关此设置的其他信息，请告诉我，我将分享。

4

1 回答 1

-1

您的链接对我不起作用...不确定您要设置什么。

我们通过Apache使用Apex进行SAML2 身份验证（创建者刚刚停止支持，但仍在大多数存储库中）。将其设置为执行SAML2 身份验证并使用用户名设置HTTP 标头，并让Apex 身份验证方案检查相同的标头以提取用户名。效果很好。mod_auth_mellon

于 2019-11-26T21:37:32.400 回答