服务端点设置问题

Question

我基于OIOSAML编写了一个带有sp启动Web SSO场景的简单系统。为了测试这个系统，我将它部署在远程主机上。

然而AssertionConsumerServiceURL，在我指定的URL上，Shibboleth idP(基于Shibboleth的idP)应该返回答案，没有被调用。

SAMLAssertionConsumer -只是一个简单的servlet，像这样:

@WebServlet("/saml/consumer")
public class SAMLAssertionConsumer extends HttpServlet {
    @Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        System.out.println(new Date() + " incoming AuthResponse");
    }
    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        response.setContentType("text/html");
        PrintWriter out = response.getWriter();
        out.println("Yes, it worked");
        System.out.println(new Date() + " incoming AuthResponse");
    }
}

首先，我只需要确保收到响应。

我的web . xml。

<?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_ID" version="3.0"
    metadata-complete="false"     
    xmlns="http://java.sun.com/xml/ns/j2ee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd" >
    <display-name>OIOSAML-J</display-name>
    <listener>
        <listener-class>dk.itst.oiosaml.sp.service.session.SessionDestroyListener</listener-class>
    </listener>
    <servlet>
        <servlet-name>SAMLDispatcherServlet</servlet-name>
        <servlet-class>dk.itst.oiosaml.sp.service.DispatcherServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>SAMLDispatcherServlet</servlet-name>
        <url-pattern>/saml/*</url-pattern>
    </servlet-mapping>
    <filter>
        <filter-name>LoginFilter</filter-name>
        <filter-class>dk.itst.oiosaml.sp.service.SPFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>LoginFilter</filter-name>
        <url-pattern>/sp/*</url-pattern>
    </filter-mapping>
    <welcome-file-list>
        <welcome-file>index.jsp</welcome-file>
    </welcome-file-list>
</web-app>

我oiosaml-sp.properties

:

# Properties used by oiosaml-j
# Reference to the location of the certificate used for signing SAML documents with - relative to ${oiosaml.home}
oiosaml-sp.certificate.location=./certificate/keystore
# Opaque/encrypted password to the certificate used for signing SAML documents
oiosaml-sp.certificate.password=some_password
# Required authentication level. 2=password, 3=certificate
oiosaml-sp.assurancelevel=2
# Name of the meta data file for the current service provider - overrides setting in brs-common.properties
common.saml2.metadata.sp.filename=SPMetadata.xml
# URI References to the current service provider
oiosaml-sp.uri.home=
# Whether to validate server certificates. Set to false in production.
# Used for artifact resolution.
oiosaml-sp.resolve.ignorecert=true
# Artifact resolution username and password. Only used the artifact profile is active.
oiosaml-sp.resolve.username=rolf.trifork.com
oiosaml-sp.resolve.password=rolf.trifork.com

生成AuthnRequest:

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
                     AssertionConsumerServiceURL="http://ip-of-remote-system-here:8080/saml/consumer"
                     Destination="http://ip-of-identity-provider-here/idp/profile/SAML2/Redirect/SSO" ForceAuthn="false"
                     ID="_31e...341d322d1d" IsPassive="false"
                     IssueInstant="2014-07-11T10:24:43.852Z"
                     ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://ip-of-remote-system-here:8080</saml2:Issuer>
</saml2p:AuthnRequest> 

有一些JSP-page private.jsp，我向它发出请求:

http://ip-of-remote-system-here:8080/sp/private.jsp

在此请求之后，我重定向到身份提供者的登录页面:

http://ip-of-identity-provider-here/idp/Authn/CommonLogin

输入一对登录名/密码和…。打开带有一些常见错误描述的页面:

http://ip-of-identity-provider-here/idp/Authn/UsernamePasswordLogin

误差

处理请求时发生错误。

不工作，我的servlet SAMLAssertionConsumer，控制台是清楚的。但是如果我向servlet SAMLAssertionConsumer直接发出请求:

http://ip-of-remote-system-here:8080/saml/consumer

那就行了。当然可以。

我想知道如何正确配置断言消费者服务。这是sp元数据的一部分，我在其中指定断言使用者。

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:esia="urn:esia:shibboleth:2.0:mdext" entityID="http://ip-of-remote-system-here:8080">
...
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"  Location="http://ip-of-remote-system-here:8080/saml/consumer" ResponseLocation="http://ip-of-remote-system-here:8080/saml/consumer"/>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://ip-of-remote-system-here:8080/saml/consumer" index="0" isDefault="true"/>

Answer 1

问题不同。使用了不正确的密钥库。现在一切都好了

最初，我假设entityID属性必须引用域名，该域名在属性Location中指定。然而，事实并非如此。它必须是唯一的，最好使用域名。

UnderstandingShibboleth EntityNaming:

Shibboleth标识和服务提供者在SAML中使用部署，因此，它们被分配一个唯一的名称，称为"entityID"。

OASIS安全断言标记语言(SAML)V2.0, 2.3.2的元数据

entityID [Required] -

 Specifies the unique identifier of the SAML entity whose metadata is 
 described by the element's contents.

UnderstandingShibboleth EntityNaming:

强烈建议不要使用服务器的物理主机名运行Shibboleth作为entityID。随着时间的流逝，事物发生了变化而且这种部署可能并不总是在同一台机器上。

此外，Shibboleth可能有多个逻辑部署在单个物理服务器上，每个服务器都需要自己唯一的entityID，所以使用服务器的名称不能扩展到单个一。

在沙箱中可以使用物理地址