SAML2 SLO与OKTA集成，命中格式错误的请求

Question

我在实现SLO时遇到了困难，遇到了Okta的“畸形请求”错误[403错误]。OKTA系统日志。

调试时，AuthController中的取消绑定开始出错。
[SingleLogout错误：ITfoxtec。身份。Saml2。Saml2BindingException：HTTP表单不包含SAMLRequest]

与link类似的设置：https://developer.okta.com/blog/2020/10/23/how-to-authenticate-with-saml-in-aspnet-core-and-csharp

[服务提供商]

_布局

<form class="form-inline" asp-controller="Auth" asp-action="Logout">
    <button type="submit">Logout</button>
</form>

AuthController

[HttpPost("Logout")]
[ValidateAntiForgeryToken]
public async Task<IActionResult> Logout() 
{
  ...... // as per link mentioned
  return binding.Bind(saml2LogoutRequest).ToActionResult();
}

[Route("LoggedOut")]
public IActionResult LoggedOut()
{
  ...... // as per link mentioned
  return Redirect(Url.Content("~/"));
}

[Route("SingleLogout")]
public async Task<IActionResult> SingleLogout()
{
  ...... // as per link mentioned
  requestBinding.Unbind(Request.ToGenericHttpRequest(), logoutRequest); // Error at Unbind
  ...... // as per link mentioned

  return responsebinding.Bind(saml2LogoutResponse).ToActionResult();
}

启动

services.Configure<Saml2Configuration>(saml2Configuration => {
  saml2Configuration.AllowedAudienceUris.Add(saml2Configuration.Issuer);
  EntityDescriptor entityDescriptor = new EntityDescriptor();
  entityDescriptor.ReadIdPSsoDescriptorFromUrl(new Uri(Configuration["Saml2:IdPMetadata"]));
  if (entityDescriptor.IdPSsoDescriptor != null) {
    saml2Configuration.SingleSignOnDestination = entityDescriptor.IdPSsoDescriptor.SingleSignOnServices.First().Location;
    saml2Configuration.SingleLogoutDestination = entityDescriptor.IdPSsoDescriptor.SingleLogoutServices.First().Location;
    saml2Configuration.SignatureValidationCertificates
            .AddRange(entityDescriptor.IdPSsoDescriptor.SigningCertificates);
     } else {
        throw new Exception("IdPSsoDescriptor not loaded from metadata.");
     }
  });

应用程序设置。json

"Saml2": {
  "IdPMetadata": "https://dev-00159484.okta.com/app/exk1hb8d9uOnEZoCd5d7/sso/saml/metadata",
  "Issuer": "SAML_TEST",
  "SignatureAlgorithm": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
  "SigningCertificateFile": "Logs\\MyServer.pfx",
  "SigningCertificatePassword": "password",
  "CertificateValidationMode": "ChainTrust",
  "RevocationMode": "NoCheck"
}

XML注销请求

<saml2p:LogoutRequest
  xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" 
  xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" 
  ID="_a6bc814d-f94d-4226-9411-1e6db8a02571" 
  Version="2.0" 
  IssueInstant="2021-11-01T07:56:26.997Z" 
  Destination="https://dev-00159484.okta.com/app/dev-00159484_samltest_1/exk1hb8d9uOnEZoCd5d7/slo/saml" 
  NotOnOrAfter="2021-11-01T08:06:26.997Z">
  <saml2:Issuer>SAML_TEST</saml2:Issuer>
  <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">[e-mail]</saml2:NameID>
  <saml2p:SessionIndex>_3d179409-2239-46c8-8d55-2ac811931dc4</saml2p:SessionIndex>
</saml2p:LogoutRequest> 

XML SingleLogout请求

<saml2p:LogoutRequest 
  xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" 
  xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" 
  ID="_4970c041-f071-4ed8-9fad-f79221abf703" Version="2.0" IssueInstant="2021-11-01T02:51:34.877Z" 
  Destination="https://dev-00159484.okta.com/app/dev-00159484_samltest_1/exk1hb8d9uOnEZoCd5d7/slo/saml" NotOnOrAfter="2021-11-01T03:01:34.877Z">
  <saml2:Issuer>SAML_TEST</saml2:Issuer>
</saml2p:LogoutRequest> 

XML注销响应

<saml2p:LogoutResponse 
    xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" 
    xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" 
    ID="_0dfec8db-eb58-4425-bb73-713e4a8a7b26" 
    Version="2.0" 
  IssueInstant="2021-11-01T02:51:35.019Z" 
  Destination="https://dev-00159484.okta.com/app/dev-00159484_samltest_1/exk1hb8d9uOnEZoCd5d7/slo/saml" 
  InResponseTo="_4970c041-f071-4ed8-9fad-f79221abf703">
  <saml2:Issuer>SAML_TEST</saml2:Issuer>
  <saml2p:Status>
    <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:RequestDenied" />
  </saml2p:Status>
</saml2p:LogoutResponse> 

[身份提供者]

Okta SSO配置和Okta SLO配置

https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2/tree/master/test无法进入SingleLogout路由。

1. 启动TestIdpCore和TestWebAppCore。
2. 点击登录TestWebAppCore。
3. 将调试器设置为SingleLogout。
4. 点击退出TestWebAppCore。

OKTA注销SAML应用程序未找到更多信息。

https://www.samltool.com/validate_logout_req.php点击错误：SAML注销请求无效。与saml-schema-protocol-2.0不匹配。xsd

Answer 1

您的LogoutRequest似乎缺少一些字段：

即：NameID谁正在注销？应该是AuthnRequest响应中的NameID。断言中的SessionIndex也很适合添加，因为如果支持，它将仅注销该会话。

<?xml version="1.0" standalone="yes"?>
<samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                     xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                     IssueInstant="2021-11-07T02:31:35Z"
                     Destination="https://dev-00159484.okta.com/app/dev-00159484_samltest_1/exk1hb8d9uOnEZoCd5d7/slo/saml"
                     Version="2.0"
                     ID="NETSAML2_e4b4513d60a464508c75e311cf8e4215">
  <saml:Issuer>SAML_TEST</saml:Issuer>
  <saml:NameID NameQualifier="https://dev-00159484.okta.com/app/dev-00159484_samltest_1/exk1hb8d9uOnEZoCd5d7/slo/saml"
               Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
               SPNameQualifier="SAML_TEST">[e-mail]</saml:NameID>
  <samlp:SessionIndex>59cd6620-8c9d-48a6-b4cc-8f63413f9f68</samlp:SessionIndex>
</samlp:LogoutRequest>