使用omniauth saml发送动态参数

Question

我需要一种使用omniauth saml将动态参数从SP发送到IDP的方法。要求有两个网站：网站1和网站2。网站1由另一个已经实施saml的团队控制。在我的网站上，我添加了一个按钮，点击它，我将向网站1发送请求。在请求的同时，我需要发送用户参数，如first\u name、last\u name、email

当我浏览文档时，我认为我需要利用

:idp_sso_target_url_runtime_params  => {:original_request_param => :mapped_idp_param}, 

但我不确定如何通过它传递动态参数。在我之前的帖子中，有人推荐我做一个猴子补丁，但它对我不起作用。有人有什么建议吗

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :saml,
    #:assertion_consumer_service_url     => "consumer_service_url",
    :issuer                             => "my_application",
    :idp_sso_target_url                 => "target_url",
    :idp_sso_target_url_runtime_params  => {:original_request_param => :mapped_idp_param},
    :idp_cert                           => "-----BEGIN CERTIFICATE-----\n...-----END CERTIFICATE-----",
    :name_identifier_format             => "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
end

Answer 1

您可以通过中间件适配器传递动态值。像：

应用/服务/saml_idp_setting_adapter.rb

class SamlIdpSettingAdapter
  def self.settings(issuer)
    idp = ::IdentityProvider.find_by_issuer(issuer)
    if idp.present?
      {
        assertion_consumer_service_url: "#{ENV['APP_URL']}/users/saml/auth",
        assertion_consumer_service_binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
        name_identifier_format: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
        issuer: "issuer",
        idp_entity_id: idp.entity_id,
        idp_slo_service_url: idp.slo_target_url,
        idp_sso_service_url: idp.sso_target_url,
        idp_cert_fingerprint: idp.cert_fingerprint,
        idp_cert_fingerprint_algorithm: 'http://www.w3.org/2000/09/xmldsig#sha256'
      }
    else
      {}
    end
  end
end

并使用上述适配器设置初始化器文件

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :saml,
    :idp_settings_adapter => SamlIdpSettingAdapter
end