验证SAML响应

Question

我有一个SAML响应和其他一些数据。基于此，我需要验证响应是否已被篡改。我该怎么办？

我有什么？

1. 带有已签名消息和声明的SAML响应

2. IdP EntityId

3. SP EntityId

4. SP ACS端点

5. 目标URL

6. X509格式的IdP证书。

需要的语言：JAVA

Answer 1

有解决方案。如果有人在寻找它。

try {
            InputStream is = new FileInputStream("<CERTIFICATE FILE>");
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            Certificate cert = cf.generateCertificate(is);
            X509Certificate x509Certificate = (X509Certificate) cert;
            PublicKey pk = x509Certificate.getPublicKey();
            BasicX509Credential publicCredential = new BasicX509Credential();
            publicCredential.setPublicKey(pk);
            SignatureValidator signatureValidator = new SignatureValidator(publicCredential);
            SignableSAMLObject signableSAMLObject = (SignableSAMLObject) <XML OBJECT>;
            Signature signature = signableSAMLObject.getSignature();
            signatureValidator.validate(signature);
        }catch(Exception ex){
            // fail this.
        }

可以使用marshaller通过以下方式从SAML消息中获取XML对象：

String encodedMessage = request.getParameter(PARAM_SAML);
String decodedMessage = new String(Base64.decodeBase64(encodedMessage.getBytes()));
DefaultBootstrap.bootstrap();
BasicParserPool ppMgr = new BasicParserPool();
ppMgr.setNamespaceAware(true);
Document responseRoot = ppMgr.parse(new StringReader(decodedMessage));
UnmarshallerFactory unmarshallFactory = Configuration.getUnmarshallerFactory();
Unmarshaller unmarshaller = unmarshallFactory.getUnmarshaller(responseRoot.getDocumentElement());
XMLObject obj = unmarshaller.unmarshall(responseRoot.getDocumentElement());