错误：XmlException:出于安全原因，在ASP.NET Core中使用SAML进行身份验证时，此XML文档中禁止DTD

Question

嘿，我正在尝试使用 asp.net 核心中的 saml 从 okta 验证应用程序，但在导航到 Okta 登录时，我收到“DTD 被禁止”错误。我正在遵循本教程：https://developer.okta.com/blog/2020/10/23/how-to-authenticate-with-saml-in-aspnet-core-and-csharp 这是我的应用程序设置.json

"Saml2": {
    "IdPMetadata": "Url of my app",
    "Issuer": "Okta_SAML_Example",
    "SignatureAlgorithm": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
    "CertificateValidationMode": "ChainTrust",
    "RevocationMode": "NoCheck"
  },
  "AllowedHosts": "*"

下面是我的startup.cs配置方法

public void ConfigureServices(IServiceCollection services)
        {
            services.AddRazorPages();

            //SAML
            services.Configure<Saml2Configuration>(Configuration.GetSection("Saml2"));

            services.Configure<Saml2Configuration>(saml2Configuration =>
            {
                saml2Configuration.AllowedAudienceUris.Add(saml2Configuration.Issuer);

                var entityDescriptor = new EntityDescriptor();
                entityDescriptor.ReadIdPSsoDescriptorFromUrl(new Uri(Configuration["Saml2:IdPMetadata"]));
                if (entityDescriptor.IdPSsoDescriptor != null)
                {
                    saml2Configuration.SingleSignOnDestination = entityDescriptor.IdPSsoDescriptor.SingleSignOnServices.First().Location;
                    //saml2Configuration.SingleLogoutDestination = entityDescriptor.IdPSsoDescriptor.SingleLogoutServices.First().Location;
                    saml2Configuration.SignatureValidationCertificates.AddRange(entityDescriptor.IdPSsoDescriptor.SigningCertificates);
                }
                else
                {
                    throw new Exception("IdPSsoDescriptor not loaded from metadata.");
                }
            });

            services.AddSaml2();  
            //END SAML
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            else
            {
                app.UseExceptionHandler("/Error");
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                app.UseHsts();
            }

            app.UseHttpsRedirection();
            app.UseStaticFiles();

            app.UseRouting();
            app.UseSaml2(); //SAML
            app.UseAuthorization();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapRazorPages();

                //SAML
                endpoints.MapControllerRoute(
                    name: "default",
                    pattern: "{controller=Home}/{action=Index}/{id?}");
                //END SAML
            });
        }

这是异常的堆栈跟踪：异常在这一行：entityDescriptor. ReadIdPSsoDescriptorFromUrl（new Uri（Configuration["Saml2：IdPMetadata"]））；

System.Xml.XmlTextReaderImpl.Throw(Exception e)
System.Xml.XmlTextReaderImpl.ParseDoctypeDecl()
System.Xml.XmlTextReaderImpl.ParseDocumentContent()
System.Xml.XmlTextReaderImpl.Read()
System.Xml.XmlLoader.Load(XmlDocument doc, XmlReader reader, bool preserveWhitespace)
System.Xml.XmlDocument.Load(XmlReader reader)
ITfoxtec.Identity.Saml2.StringExtensions.ToXmlDocument(string xml)
ITfoxtec.Identity.Saml2.Schemas.Metadata.EntityDescriptor.ReadIdPSsoDescriptor(string idPMetadataXml)
ITfoxtec.Identity.Saml2.Schemas.Metadata.EntityDescriptor.ReadIdPSsoDescriptorFromUrl(Uri idPMetadataUrl)
Okta_SAML_Example.Startup.<ConfigureServices>b__4_0(Saml2Configuration saml2Configuration) in Startup.cs
+
                **entityDescriptor.ReadIdPSsoDescriptorFromUrl(new Uri(Configuration["Saml2:IdPMetadata"]));**
Microsoft.Extensions.Options.ConfigureNamedOptions<TOptions>.Configure(string name, TOptions options)
Microsoft.Extensions.Options.OptionsFactory<TOptions>.Create(string name)
Microsoft.Extensions.Options.OptionsManager<TOptions>+<>c__DisplayClass5_0.<Get>b__0()
System.Lazy<T>.ViaFactory(LazyThreadSafetyMode mode)
System.Lazy<T>.ExecutionAndPublication(LazyHelper executionAndPublication, bool useDefaultConstructor)
System.Lazy<T>.CreateValue()
System.Lazy<T>.get_Value()
Microsoft.Extensions.Options.OptionsCache<TOptions>.GetOrAdd(string name, Func<TOptions> createOptions)
Microsoft.Extensions.Options.OptionsManager<TOptions>.Get(string name)
Microsoft.Extensions.Options.OptionsManager<TOptions>.get_Value()
Okta_SAML_Example.Controllers.AuthController..ctor(IOptions<Saml2Configuration> configAccessor) in AuthController.cs
+
            config = configAccessor.Value;
lambda_method(Closure , IServiceProvider , object[] )
Microsoft.AspNetCore.Mvc.Controllers.ControllerActivatorProvider+<>c__DisplayClass4_0.<CreateActivator>b__0(ControllerContext controllerContext)
Microsoft.AspNetCore.Mvc.Controllers.ControllerFactoryProvider+<>c__DisplayClass5_0.<CreateControllerFactory>g__CreateController|0(ControllerContext controllerContext)
Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(ref State next, ref Scope scope, ref object state, ref bool isCompleted)
Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeInnerFilterAsync()
Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeNextResourceFilter>g__Awaited|24_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, object state, bool isCompleted)
Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Rethrow(ResourceExecutedContextSealed context)
Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Next(ref State next, ref Scope scope, ref object state, ref bool isCompleted)
Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.InvokeFilterPipelineAsync()
Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope)
Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)

如何解决此错误？

Answer 1

面对同样的。在我的例子中，这意味着我用HTML形式输入登录/密码，而不是用XML和元数据