问题：

ADFS：SAML签名验证依赖于什么

吕承福

2023-03-14

我有自己的ADFS部署在网上。

我让它信任一些像SAMLtest.id这样的SPs在配置这个信任的过程中，我每次只填写两件事：

SALM ACS
依赖方信任标识符（SAML发行者）

仅此而已。没有SP元数据文件，只有这两条信息。然后它工作，SAMLtest.id SP 被我的 ADFS 信任，我就可以执行 SSO 身份验证。同样的事情是与一些内部SP一起工作。

然后每个SP从其元数据文件中信任我的ADFS IdP。

但是现在我们正在开发一个基于SAML Crewam库的SP，并且发生了一种奇怪的行为。为了执行我们给予ADFS的信任，我们还向ADFS提供了ACS和标识符，但显然它还需要验证SAML签名，因为当我尝试执行SSO身份验证时会出现错误：

MSIS0037：找不到发行者https：//的签名验证证书

错误消息非常清楚，所以我添加了SP用来签署SAML请求的证书，现在它工作了，我可以执行SSO连接。

这就是我不明白的地方:为什么有的sp被我的ADFS信任而不需要添加签名验证证书，而有的却需要呢？

这是SAMLtest的SAML请求。id（在没有签名验证证书的情况下工作）：

<samlp:AuthnRequest
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    AssertionConsumerServiceURL="https://samltest.id/Shibboleth.sso/SAML2/POST"
                    Destination="https://<my_adfs_idp>/adfs/ls/"
                    ID="_22d23a57f0d6359675246083cc8faf2e"
                    IssueInstant="2022-02-22T13:45:40Z"
                    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    Version="2.0">
    <saml:Issuer
        xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://samltest.id/saml/sp
    </saml:Issuer>
    <samlp:NameIDPolicy AllowCreate="1" />
</samlp:AuthnRequest>

这是我们基于Crewam的自定义SP的SAML请求（没有签名验证证书将无法工作）：

<samlp:AuthnRequest
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    ID="id-97c753d96c1a9bcabcb4931465d9b7dcb9e35e21"
                    Version="2.0"
                    IssueInstant="2022-02-22T10:42:53.434Z"
                    Destination="https://<my_adfs_idp>/adfs/ls/"
                    AssertionConsumerServiceURL="https://<my_sp>/self-service/methods/saml/acs"
                    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    >
    <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://<my_sp>/self-service/methods/saml/acs</saml:Issuer>
    <samlp:NameIDPolicy AllowCreate="true" />
</samlp:AuthnRequest>

编辑1：

以下是通过Get-AdfsRelyingPartyTrust获得的一些附加信息。

对于SAMLtestid：

AllowedAuthenticationClassReferences : {}
EncryptionCertificateRevocationCheck : CheckChainExcludeRoot
PublishedThroughProxy                : False
SigningCertificateRevocationCheck    : CheckChainExcludeRoot
WSFedEndpoint                        :
AdditionalWSFedEndpoint              : {}
ClaimsProviderName                   : {}
ClaimsAccepted                       : {}
EncryptClaims                        : True
Enabled                              : True
EncryptionCertificate                :
Identifier                           : {https://samltest.id/saml/sp}
NotBeforeSkew                        : 0
EnableJWT                            : False
AlwaysRequireAuthentication          : False
Notes                                :
OrganizationInfo                     :
ObjectIdentifier                     : 29c4b776-ff8f-ec11-8e3f-fd3950cefa56
ProxyEndpointMappings                : {}
ProxyTrustedEndpoints                : {}
ProtocolProfile                      : WsFed-SAML
RequestSigningCertificate            : {}
EncryptedNameIdRequired              : False
SignedSamlRequestsRequired           : False
SamlEndpoints                        : {Microsoft.IdentityServer.Management.Resources.SamlEndpoint}
SamlResponseSignature                : AssertionOnly
SignatureAlgorithm                   : http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
TokenLifetime                        : 0
AllowedClientTypes                   : Public, Confidential
IssueOAuthRefreshTokensTo            : AllDevices
RefreshTokenProtectionEnabled        : True
RequestMFAFromClaimsProviders        : False
ScopeGroupId                         :
ScopeGroupIdentifier                 :
DeviceAuthenticationMethod           :
Name                                 : SAML Test ID
AutoUpdateEnabled                    : False
MonitoringEnabled                    : False
MetadataUrl                          :
ConflictWithPublishedPolicy          : False
IssuanceAuthorizationRules           :
IssuanceTransformRules               : @RuleTemplate = "LdapClaims"
                                       @RuleName = "Send LDAP Attributes as Claims"
                                       c:[Type ==
                                       "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
                                       Issuer == "AD AUTHORITY"]
                                        => issue(store = "Active Directory", types =
                                       ("http://schemas.xmlsoap.org/claims/Group",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"), query =
                                       ";title,mail,givenName,displayName,sn,sAMAccountName;{0}", param = c.Value);


DelegationAuthorizationRules         :
LastPublishedPolicyCheckSuccessful   :
LastUpdateTime                       : 1/1/1900 1:00:00 AM
LastMonitoredTime                    : 1/1/1900 1:00:00 AM
ImpersonationAuthorizationRules      :
AdditionalAuthenticationRules        :
AccessControlPolicyName              : Permit everyone
AccessControlPolicyParameters        :
ResultantPolicy                      : RequireFreshAuthentication:False
                                       IssuanceAuthorizationRules:
                                       {
                                         Permit everyone
                                       }

对于我的基于Crewjam的SP(在我添加证书之前):

AllowedAuthenticationClassReferences : {}
EncryptionCertificateRevocationCheck : CheckChainExcludeRoot
PublishedThroughProxy                : False
SigningCertificateRevocationCheck    : CheckChainExcludeRoot
WSFedEndpoint                        :
AdditionalWSFedEndpoint              : {}
ClaimsProviderName                   : {}
ClaimsAccepted                       : {}
EncryptClaims                        : True
Enabled                              : True
EncryptionCertificate                :
Identifier                           : {https://samltest.id/saml/sp}
NotBeforeSkew                        : 0
EnableJWT                            : False
AlwaysRequireAuthentication          : False
Notes                                :
OrganizationInfo                     :
ObjectIdentifier                     : 29c4b776-ff8f-ec11-8e3f-fd3950cefa56
ProxyEndpointMappings                : {}
ProxyTrustedEndpoints                : {}
ProtocolProfile                      : WsFed-SAML
RequestSigningCertificate            : {}
EncryptedNameIdRequired              : False
SignedSamlRequestsRequired           : False
SamlEndpoints                        : {Microsoft.IdentityServer.Management.Resources.SamlEndpoint}
SamlResponseSignature                : AssertionOnly
SignatureAlgorithm                   : http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
TokenLifetime                        : 0
AllowedClientTypes                   : Public, Confidential
IssueOAuthRefreshTokensTo            : AllDevices
RefreshTokenProtectionEnabled        : True
RequestMFAFromClaimsProviders        : False
ScopeGroupId                         :
ScopeGroupIdentifier                 :
DeviceAuthenticationMethod           :
Name                                 : SAML Test ID
AutoUpdateEnabled                    : False
MonitoringEnabled                    : False
MetadataUrl                          :
ConflictWithPublishedPolicy          : False
IssuanceAuthorizationRules           :
IssuanceTransformRules               : @RuleTemplate = "LdapClaims"
                                       @RuleName = "Send LDAP Attributes as Claims"
                                       c:[Type ==
                                       "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
                                       Issuer == "AD AUTHORITY"]
                                        => issue(store = "Active Directory", types =
                                       ("http://schemas.xmlsoap.org/claims/Group",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"), query =
                                       ";title,mail,givenName,displayName,sn,sAMAccountName;{0}", param = c.Value);


DelegationAuthorizationRules         :
LastPublishedPolicyCheckSuccessful   :
LastUpdateTime                       : 1/1/1900 1:00:00 AM
LastMonitoredTime                    : 1/1/1900 1:00:00 AM
ImpersonationAuthorizationRules      :
AdditionalAuthenticationRules        :
AccessControlPolicyName              : Permit everyone
AccessControlPolicyParameters        :
ResultantPolicy                      : RequireFreshAuthentication:False
                                       IssuanceAuthorizationRules:
                                       {
                                         Permit everyone
                                       }

正如您所看到的，这两种配置之间没有什么不同，除了标识符、对象标识符和名称。

在这两种情况下，SignedSamlRequest ests必需为False。

编辑2：

下面是提供给 SP 的 ADFS IdP 元数据文件。由于 ADFS 元数据文件非常庞大，因此这里有一个简化版本，导致完全相同的结果（为了更清晰起见，隐藏了证书）：

<?xml version="1.0"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2022-02-24T13:41:36Z" cacheDuration="PT1646142096S" entityID="http://<my_adfs_idp>/adfs/services/trust">
  <md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <md:KeyDescriptor use="signing">
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
          <ds:X509Certificate>...</ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>
    <md:KeyDescriptor use="encryption">
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
          <ds:X509Certificate>...</ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>
    <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://<my_adfs_idp>/adfs/ls/"/>
  </md:IDPSSODescriptor>
</md:EntityDescriptor>

这是SP元数据文件（出于同样的原因，证书也被隐藏），但没有提供给ADFS IdP，因为它只接受ACS和标识符值（有时是签名验证证书，这是我的问题）：

<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2022-02-26T10:50:18.198Z" entityID="https://<my_sp>/self-service/methods/saml/acs">
  <SPSSODescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2022-02-26T10:50:18.198103727Z" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="true" WantAssertionsSigned="true">
    <KeyDescriptor use="encryption">
      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
        <X509Data xmlns="http://www.w3.org/2000/09/xmldsig#">
          <X509Certificate xmlns="http://www.w3.org/2000/09/xmldsig#">...</X509Certificate>
        </X509Data>
      </KeyInfo>
      <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"></EncryptionMethod>
      <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes192-cbc"></EncryptionMethod>
      <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"></EncryptionMethod>
      <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"></EncryptionMethod>
    </KeyDescriptor>
    <KeyDescriptor use="signing">
      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
        <X509Data xmlns="http://www.w3.org/2000/09/xmldsig#">
          <X509Certificate xmlns="http://www.w3.org/2000/09/xmldsig#">...</X509Certificate>
        </X509Data>
      </KeyInfo>
    </KeyDescriptor>
    <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://<my_sp>:4455/saml/slo" ResponseLocation="https://<my_sp>:4455/saml/slo"></SingleLogoutService>
    <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://<my_sp>/self-service/methods/saml/acs" index="1"></AssertionConsumerService>
    <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://<my_sp>/self-service/methods/saml/acs" index="2"></AssertionConsumerService>
  </SPSSODescriptor>
</EntityDescriptor>

狄兴业

2023-03-14

您可以通过任意一种方式配置SP。

[-SignedSamlRequestsRequired <Boolean>]

ADFS：SAML签名验证依赖于什么

共有1个答案

相关问答

相关文章

相关阅读

相关工具

相关文档