Spring SAML:SAML消息预期的目标终结点与收件人终结点不匹配

Question

当我的应用程序SP和客户端IdP之间出现SSO时，我收到了“由：org.opensaml.xml.security.SecurityException：SAML消息预期目标endpoint与收件人endpoint不匹配”的“异常”。

服务器日志显示了架构的差异，请参见下文：

Checking SAML message intended destination endpoint against receiver endpoint
2019-03-05 15:02:44.599 DEBUG [204 default task-41][BaseSAMLMessageDecoder] Intended message destination endpoint: https://my.app.com/app-gateway/saml/SSO
2019-03-05 15:02:44.599 DEBUG [204 default task-41][BaseSAMLMessageDecoder] Actual message receiver endpoint: http://my.app.com/app-gateway/saml/SSO
2019-03-05 15:02:44.600 ERROR [204 default task-41][BaseSAMLMessageDecoder] SAML message intended destination endpoint 'https://my.app.com/app-gateway/saml/SSO' did not match the recipient endpoint 'http://my.app.com/app-gateway/saml/SSO'

我的应用程序在2个实例上的STG上运行，LB在前，因此我使用< code > SAMLContextProviderLB 上下文提供程序，而不是< code > SAMLContextProviderImpl :

<bean id="contextProvider" class="org.springframework.security.saml.context.SAMLContextProviderLB">
        <property name="scheme" value="https"/>
        <property name="serverName" value="my.app.com"/>
        <property name="serverPort" value="443"/>
        <property name="includeServerPortInRequestURL" value="false"/>
        <property name="contextPath" value="/app-gateway"/>
    </bean>

<bean id="metadataGeneratorFilter" class="org.springframework.security.saml.metadata.MetadataGeneratorFilter">
        <constructor-arg>
            <bean class="org.springframework.security.saml.metadata.MetadataGenerator">
                <property name="entityBaseURL" value="https://my.app.com/app-gateway1"/>
                <property name="entityId" value="${cas.sso.entityId}"/>
                <property name="includeDiscoveryExtension" value="false"/>
                <property name="extendedMetadata" ref="extendedMetadata"/>
                <property name="keyManager" ref="keyManager"/>
            </bean>
        </constructor-arg>
    </bean>

在< code > getactualreceiverndpointuri 的源代码中，接收方endpointURL取自request < code > http request obj。因此，我试图了解http://my.app.com/app-gateway/saml/SSO在哪一步设置了错误的网址。有人能给我解释一下吗？

protected String getActualReceiverEndpointURI(SAMLMessageContext messageContext) throws MessageDecodingException {
        InTransport inTransport = messageContext.getInboundMessageTransport();
        if (! (inTransport instanceof HttpServletRequestAdapter)) {
            log.error("Message context InTransport instance was an unsupported type: {}", 
                    inTransport.getClass().getName());
            throw new MessageDecodingException("Message context InTransport instance was an unsupported type");
        }
        HttpServletRequest httpRequest = ((HttpServletRequestAdapter)inTransport).getWrappedRequest();

        StringBuffer urlBuilder = httpRequest.getRequestURL();

        return urlBuilder.toString();
    }

Answer 1

对于运行在AWS Application负载均衡器后面的Apache Tomcat服务器，需要启用RemoteIPValue，以便根据x-readed-proto标头，Tomcat将覆盖方案（https）

在服务器中.xml

<Valve className="org.apache.catalina.valves.RemoteIpValve" protocolHeader="X-Forwarded-Proto" internalProxies="10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|169\.254\.\d+\.\d+|127\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+" />

Answer 2

您可能需要查看以下页面：https://developer.jboss.org/thread/240113

我也遇到了类似的问题，即使在LB上正确设置了X-Forwarded-Proto，请求仍然只在http中解释。后端必须知道标头。

在超文本传输协议侦听器和两个filter-ref上添加proxy-address-转发="true"

<http-listener name="default" socket-binding="http" proxy-address-forwarding="true"/>  
            <filter-ref name="server-header"/>  
            <filter-ref name="x-powered-by-header"/>  

希望这个有帮助，