使用openSAML签名响应

时间：2012-11-13 20:24:31

标签： java xml opensaml

我试图通过签署响应而不是Assertion来实现SAML 2.0。我有3个现有供应商在Assertion级别接受我的签名，但是新供应商正在协议/响应级别请求它。我一直在谷歌搜索和调试大约8个小时，并找不到我做错的有效例子。我的代码清楚地显示了我在做什么，最后10行左右是我实现的差异（在if / else中）。另外，我在XML中注意到我的SignatureValue和DigestValue都是空的。任何人都可以指向一些明确的文档，或者更好的是，使用openSAML的工作响应签名的示例？在这一点上，任何帮助表示赞赏。 

Assertion assertion = OpenSamlHelper.CreateSamlAssertion(
            issuer.trim(), recipient.trim(), domain.trim(), subject.trim(),
            attributes);        


    //
    // Sign
    //
    Credential signingCredential = getSigningCredential(keystore, storetype, storepass, alias, keypass);

    Signature signature = (Signature) Configuration.getBuilderFactory()
                            .getBuilder(Signature.DEFAULT_ELEMENT_NAME)
                            .buildObject(Signature.DEFAULT_ELEMENT_NAME);

    signature.setSigningCredential(signingCredential);
    signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1);               
    signature.setCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS);



            SecurityConfiguration secConfiguration = Configuration.getGlobalSecurityConfiguration(); 
            NamedKeyInfoGeneratorManager namedKeyInfoGeneratorManager = secConfiguration.getKeyInfoGeneratorManager(); 
            KeyInfoGeneratorManager keyInfoGeneratorManager = namedKeyInfoGeneratorManager.getDefaultManager();
            KeyInfoGeneratorFactory keyInfoGeneratorFactory = keyInfoGeneratorManager.getFactory(signingCredential);
            KeyInfoGenerator keyInfoGenerator = keyInfoGeneratorFactory.newInstance();
            KeyInfo keyInfo = null;
            try {
                keyInfo = keyInfoGenerator.generate(signingCredential);
            } catch  (Exception e) {
                logger.error(e);
            } 
            signature.setKeyInfo(keyInfo);

            String saml = "";
            try {
            MarshallerFactory marshallerFactory = Configuration.getMarshallerFactory();
    if (signatureType == SignatureType.Response) {
        response.setSignature(signature);
                    marshallerFactory.getMarshaller(response).marshall(response);
    }
    if (signatureType == SignatureType.Assertion) {
        assertion.setSignature(signature);
                    marshallerFactory.getMarshaller(assertion).marshall(assertion);
    }
        Signer.signObject(signature);

更新：我使用上述代码获得的XML不包含signatureValue或Digest Value，如下所示.. 

<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#_651cc837-e890-46c7-9cf9-646ffd38aaad">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="xs"/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue/>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue/>

移动Signer.signObject（签名）后;断言附加到响应后的某个点，我收到以下XML .. 

<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#_273e38e9-3b51-4845-8b8b-f0970e3e9bab">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="xs"/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>UlVtsjSAvtjOLMbw+HUX9n7FtxM=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
jM7GxZ77VBHuAatMXLx14s0ExOmmfDpBhCpF8OKV4F3C1BiRutM41aTH25yhgSn+6l4TkK6kEDbFOYI6isvJUhtdVgH4E1xJl0DFfvPJphTF096acvJrLPehpsFd2Ab6sARuV1sbg/gwNFzvlHJWgit5NxHNuFN1qcv3vuhvQ83fOfxxuyLyJrEjpqvbRzwWepHiuTVHlNObrUvjVxEc7AUKPtwTqGlA6y3SdzIDwjN/LsB1V6PWhiMZsbxJx3LUuk5UECOYmRhKQifZWdOdvHoWBq05J54I6RvAplNDTfRBr4AM+tfIz3OXpN6OpKdSC43HRg9LO9bXprui+4CvrQ==
</ds:SignatureValue>

2 个答案:

答案 0 :(得分：2)

我尝试使用此代码进行签名和工件响应，只需将entityDescriptor切换为artifactResponse并且工作正常。 http://mylifewithjava.blogspot.no/2012/11/signing-with-opensaml.html 

<?xml version="1.0" encoding="UTF-8"?><saml2p:ArtifactResponse xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Version="2.0">
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>ZkE02ZnvIqyd+FcfL6PaXNI88Co=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>fDxfW06rbJEFu5nqmsGxwt6O53N8FWwmDOO0e3nUWh0in2TRYD9nj2927pnQZNL4Mk3KAcSWVETUuHX11XWL+MgcosfJd31TR0XEui/F+BbojQlXJRHfD2BfEO9cQCygFSyyOb9tE2FU5noqnx2b3vI5mToam3a135007mAN/t14Jm71EfvvCF9qL2wXI55R8uab0WGqXx1LYSrAjBZq455SH9AIQu+n8L+KaiOzfpjiL+h/5YJ/a+uyiLV6H06TsytowDTBSW67YW110fpoOsD5vgULrZOABmeK6NRZWpI8PK1M+/r6SO0DTEbUiSTYtHz9XBcqbnD9d7ZQ3oZpEQ==</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>MIIDaTCCAlGgAwIBAgIEeL6vczANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJOTzENMAsGA1UE
CBMET3NsbzENMAsGA1UEBxMET3NsbzEOMAwGA1UEChMFQ2FwcmExDTALBgNVBAsTBGphdmExGTAX
BgNVBAMTEFN0ZWZhbiBSYXNtdXNzb24wHhcNMTIxMTA5MTA1MzU0WhcNMTMwMjA3MTA1MzU0WjBl
MQswCQYDVQQGEwJOTzENMAsGA1UECBMET3NsbzENMAsGA1UEBxMET3NsbzEOMAwGA1UEChMFQ2Fw
cmExDTALBgNVBAsTBGphdmExGTAXBgNVBAMTEFN0ZWZhbiBSYXNtdXNzb24wggEiMA0GCSqGSIb3
DQEBAQUAA4IBDwAwggEKAoIBAQCJFImFwnmxM28bSTWOIKCIW1nkZ4euYbB+aLFwc8nJZ0Go5+B3
sT4gxF5Cr2/syglO9fwNJH+hdIw9qXTcnZL6THGSlb7Hcci/541z3BdaljZ/DFqcvL6BzsY0uBc+
3ZbOEr+n3wADZ12GW1Pz7GxjZncJZUwDgO7M/wtscd4jZD7iRnRMux8dVbg8O1ywE16GEM/UkwF3
Xz98T4/TiEviPLrb+c5IO7KhZyJWndKOucTYUwhi4EZ169XSN03KMZeiMewxqcW4n1fb+GksN/TE
5Pl0Ci/0gSaAQKYTqAlIZ2TS7oQ0MRnI0jsjsUZDFbznTXBwticfHnoTyHDA4sctAgMBAAGjITAf
MB0GA1UdDgQWBBQUSNk3I5z4oXsByufaV51IgzuFdTANBgkqhkiG9w0BAQsFAAOCAQEAFmsaXdGS
fyHjYZzUrZKnX6xjJpB7UA48gd/0/Tylm1zfp+GeRGV3/hQan3+UuV8zrE9lhDUbgnoFFY2Xebrc
5Ij5DS3pEz8xi+isDCqvHrBGCMQ4G6eRUTxVz4VucY1j8G34+X5KECibyuCGPP1yXZf+57CciSpp
8tWGBPI1mOuCmEdiucMapJmZa8uQo5FqWZXoJ0cQgZZ1BEgNERAcCZ5xqF03tpfgFuIu7/arp77i
JKYWPX/a82feabjeecH+gAsWi8Tt1ixKNeNJklFY1GAllxwoDAYcxjjWxIbRh9Bl5Kaaf3S0da3p
Mkv4S1zTI0Bq/WcR5e0GHUFm4one3g==</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
</saml2p:ArtifactResponse>

尝试跳过KeyInfo部分。您没有收到任何编组错误？

答案 1 :(得分：0)

我有同样的问题，但在我添加

之后 
 KeyInfoGenerator keyInfoGeneratorFactory= keyInfoGeneratorFactory.newInstance();
  if (keyInfoGeneratorFactory instanceof X509KeyInfoGeneratorFactory) {
                ((X509KeyInfoGeneratorFactory) keyInfoGeneratorFactory).setEmitX509Digest(Boolean.TRUE);
                ((X509KeyInfoGeneratorFactory) keyInfoGeneratorFactory).setEmitX509IssuerSerial(Boolean.FALSE);
                ((X509KeyInfoGeneratorFactory) keyInfoGeneratorFactory).setEmitEntityCertificate(Boolean.FALSE);
                ((X509KeyInfoGeneratorFactory) keyInfoGeneratorFactory).setEmitPublicKeyValue(Boolean.FALSE);
                ((X509KeyInfoGeneratorFactory) keyInfoGeneratorFactory).setX509DigestAlgorithmURI(SignatureConstants.ALGO_ID_DIGEST_SHA1);}

并且

{{1}}
相关问题
最新问题