ITfoxtec SAML 2.0:配置AWS SSO时出现InvalidSignatureException

Question

我有一个小的测试应用程序，我已经成功地与Okta集成为IdP。我还建立了AWS SSO作为IdP。当我将应用程序切换到使用AWS SSO时，我收到以下错误:

ITfoxtec.Identity.Saml2.Cryptography.InvalidSignatureException: Signature is invalid.
   at ITfoxtec.Identity.Saml2.Saml2Request.ValidateXmlSignature(SignatureValidation documentValidationResult)
   at ITfoxtec.Identity.Saml2.Saml2Request.Read(String xml, Boolean validateXmlSignature)
   at ITfoxtec.Identity.Saml2.Saml2Response.Read(String xml, Boolean validateXmlSignature)
   at ITfoxtec.Identity.Saml2.Saml2AuthnResponse.Read(String xml, Boolean validateXmlSignature)
   at ITfoxtec.Identity.Saml2.Saml2PostBinding.Read(HttpRequest request, Saml2Request saml2RequestResponse, String messageName, Boolean validateXmlSignature)
   at ITfoxtec.Identity.Saml2.Saml2PostBinding.UnbindInternal(HttpRequest request, Saml2Request saml2RequestResponse, String messageName)
   at ITfoxtec.Identity.Saml2.Saml2Binding`1.Unbind(HttpRequest request, Saml2Response saml2Response)
   at SAML_Example.Controllers.AuthController.AssertionConsumerService() in C:\Workspace\saml\SAML_Example\AuthController.cs:line 46
   at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.TaskOfIActionResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeActionMethodAsync>g__Awaited|12_0(ControllerActionInvoker invoker, ValueTask`1 actionResultValueTask)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeNextActionFilterAsync>g__Awaited|10_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeInnerFilterAsync()
--- End of stack trace from previous location where exception was thrown ---
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeNextResourceFilter>g__Awaited|24_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Rethrow(ResourceExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.InvokeFilterPipelineAsync()
--- End of stack trace from previous location where exception was thrown ---
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope)
   at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)

我已经验证了AWS SSO返回的签名算法与Okta返回的匹配，http://www.w3.org/2001/04/xmldsig-more#rsa-sha256.是否有人成功地将ITfoxtec配置为AWS SSO？

Answer 1

我的理解是，断言标记通常是经过签名的。在AWS的情况下，他们对断言标记以及整个响应进行签名。断言标记的签名不会为我验证，但整个响应的签名会验证。我想既然断言在响应中，它也可以被认为是有效的。

我删除了对unbind的调用，并将其替换为以下内容：

var certValidation = true;
var cert = _samlConfig.SignatureValidationCertificates.FirstOrDefault();
var nodes = saml2AuthnResponse.XmlDocument.SelectNodes("//*[local-name()='Signature']").ToEnumerable().ToList();
var responseSignature = nodes.FirstOrDefault(n => n?.ParentNode?.LocalName == "Response");
if (responseSignature != null)
{
    var signedXml = new SignedXml(responseSignature.ParentNode as XmlElement);
    signedXml.LoadXml(responseSignature as XmlElement);
    certValidation = signedXml.CheckSignature(cert, true);
}
else
{
    foreach (var node in nodes)
    {
        var signedXml = new SignedXml(node.ParentNode as XmlElement);
        signedXml.LoadXml(node as XmlElement);
        certValidation = certValidation && signedXml.CheckSignature(cert, true);
    }
}

如果整个响应上没有签名，它会恢复到原始行为并检查存在的每个签名。

Answer 2

与 Okta 和 AWS 的集成是基于元数据，还是通过配置 IdP 证书来配置对外部 IdP 的信任？

听起来您正在针对不正确的证书验证AWS IdP。