Spring SAML发送错误的AuthNRequest

Question

@Bean
    public MetadataGenerator metadataGenerator() {
        MetadataGenerator metadataGenerator = new MetadataGenerator();
        metadataGenerator.setEntityId(env.getProperty("saml.entity.id"));
        metadataGenerator.setExtendedMetadata(extendedMetadata());
        metadataGenerator.setIncludeDiscoveryExtension(false);
        metadataGenerator.setKeyManager(keyManager());
        return metadataGenerator;
    }

@Bean
    @Qualifier("idp-ssocircle")
    public ExtendedMetadataDelegate ssoCircleExtendedMetadataProvider() throws MetadataProviderException {
        String idpSSOCircleMetadataURL = env.getProperty("saml.provider.url");
        HTTPMetadataProvider httpMetadataProvider = new HTTPMetadataProvider(this.backgroundTaskTimer, httpClient(),
                idpSSOCircleMetadataURL);
        httpMetadataProvider.setParserPool(parserPool());
        ExtendedMetadataDelegate extendedMetadataDelegate = new ExtendedMetadataDelegate(httpMetadataProvider,
                extendedMetadata());
        extendedMetadataDelegate.setMetadataTrustCheck(true);
        extendedMetadataDelegate.setMetadataRequireSignature(false);
        backgroundTaskTimer.purge();
        return extendedMetadataDelegate;
    }

saml.entity.id=urn:saml2:test:s
saml.provider.url=https://fedsvc-stage.pwc.com/ofiss/FederationMetadata/2007-06/FederationMetadata.xml

现在我正在尝试访问SAML身份验证背后的url-

http://mysso.com:8080/sso-self/auth/login

用户get重定向到他输入凭据的IDP，在完整身份验证成功后，用户get重定向回-http://localhost:8080/sso-self/saml/sso，带有saml响应，但我在浏览器上得到404，控制台上出现以下错误-

org.opensaml.common.SAMLException: InResponseToField of the Response doesn't correspond to sent message a330ei589j3e99ee10d8a55bghc518i

我可以看到的问题是，当第一个请求来自域名mysso.com时，消息是从两个不同的会话存储和检索的，但响应返回到本地主机

<?xml version="1.0" encoding="UTF-8"?><saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="http://localhost:8080/madison-sso-self/saml/SSO" Destination="https://fedsvc-stage.pwc.com/ofiss/" ForceAuthn="false" ID="a345ia5236e6hc2g48ea13fcf4386h7" IsPassive="false" IssueInstant="2018-12-18T07:46:41.812Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">
   <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:saml2:test:s</saml2:Issuer>
</saml2p:AuthnRequest>

如果你需要更多的信息来解决问题，请回复。提前谢了。

Answer 1

您可以使用SAMLContextProviderLB来解决此问题。请用您的服务器URL替换下面配置中的值。

@Bean
public SAMLContextProviderLB contextProvider() {
  SAMLContextProviderLB samlContextProviderLB = new SAMLContextProviderLB();
  samlContextProviderLB.setScheme("https");
  samlContextProviderLB.setServerName("www.myserver.com");
  samlContextProviderLB.setServerPort(443);
  samlContextProviderLB.setContextPath("/spring-security-saml2-sample");
  samlContextProviderLB.setStorageFactory(new EmptyStorageFactory());
  return samlContextProviderLB;
}

上面的配置将使用https://www.myserver.com/spring-security-saml2-sample/SAML/sso从SAML服务提供者重定向。

samlContextProviderLB.setStorageFactory(new EmptyStorageFactory());

上面的代码行将有助于解决多会话问题。