我一直在尝试使用ForgeRock的OpenIG Identity Gateway来集成一些遗留系统，特别是我正在使用OpenACS + .LRN这个项目，来自Ars Digita和不同的机构。
问题在于：使用OpenIG文档中的配方提取隐藏值并回复请求的cookie以避免安全问题，我获得了成功的POST请求以登录系统但是在请求之后，OpenACS log告诉我，最初的请求请求类似http://10.10.10.10/register而不是真实的客户请求http://openacs-domain.com/register，并打破302重定向到IP方向以进行新的登录。
我修改了/ etc / hosts以检查它是否执行了名称解析而没有成功。
奇怪的是，如果我在初始请求发回时返回域，我会有一个有效的启动会话，一切都很酷。
我希望我有足够的描述性，并且有人为此提供了解决方案。我将附上我的config.json
{
"heap": {
"objects": [
{
"name": "HandlerServlet",
"comment": "Entry point that transforms Servlet request to handler request.",
"type": "HandlerServlet",
"config": {
"handler": "DispatchHandler",
"baseURI":"http://10.10.10.10"
}
},
{
"name": "DispatchHandler",
"type": "DispatchHandler",
"config": {
"bindings": [
{
"condition": "${exchange.request.uri.path == '/register/'}",
"handler": "LoginChain"
},
{
"handler": "OutgoingChain",
},
]
}
},
{
"name": "LoginChain",
"type": "Chain",
"config": {
"filters": ["SwitchFilter", "HiddenValueExtract"],
"handler": "OutgoingChain"
}
},
{
"name": "HiddenValueExtract",
"type": "EntityExtractFilter",
"config": {
"messageType": "response",
"target": "${exchange.hiddenValue}",
"bindings": [
{
"key": "time",
"pattern": "time\"\s.*value=\"(.{10})\"",
"template": "$1"
},
{
"key": "tokenId",
"pattern": "token_id\"\s.*value=\"(.{3})\"",
"template": "$1"
},
{
"key": "hash",
"pattern": "hash\"\s.*value=\"(.*)\"",
"template": "$1"
}
]
}
},
{
"name": "SwitchFilter",
"type": "SwitchFilter",
"config": {
"onResponse": [
{
"condition": "${exchange.response.status == 200}",
"handler": "LoginRequestHandler"
}
]
}
},
{
"name": "LoginRequestHandler",
"type": "Chain",
"config": {
"filters": ["LoginRequest"],
"handler": "OutgoingChain"
}
},
{
"name": "LoginRequest",
"type": "StaticRequestFilter",
"config": {
"method": "POST",
"uri": "http://10.10.10.10/register/",
"form": {
"form:mode": ["edit"],
"form:id": ["login"],
"__confirmed_p": ["0"],
"__refreshing_p": ["0"],
"return_url": ["/dotlrn/control-panel"],
"time": ["${exchange.hiddenValue.time}"],
"token_id": ["${exchange.hiddenValue.tokenId}"],
"hash": ["${exchange.hiddenValue.hash}"]
"email": ["user.example@gmail.com"],
"password": ["password"]
}
"headers": {
"cookie": ["${exchange.response.headers['Set-Cookie'][0]}"],
}
}
},
{
"name": "OutgoingChain",
"type": "Chain",
"config": {
"filters": ["CaptureFilter"],
"handler": "ClientHandler"
}
},
{
"name": "CaptureFilter",
"type": "CaptureFilter",
"config": {
"captureEntity": false,
"file": "/tmp/gateway.log",
}
},
{
"name": "ClientHandler",
"comment": "Responsible for sending all requests to remote servers.",
"type": "ClientHandler",
"config": {
}
}
]
},
"servletObject": "HandlerServlet",
}
答案 0 :(得分：1)
这是最终版本：
{
"heap": {
"objects": [
{
"name": "LogSink",
"comment": "Default sink for logging information.",
"type": "ConsoleLogSink",
"config": {
"level": "DEBUG",
}
},
{
"name": "DispatchServlet",
"type": "DispatchServlet",
"config": {
"bindings": [
{
"pattern":"^/saml",
"object":"FederationServlet"
},
{
"pattern":"",
"object":"HandlerServlet"
}
]
}
},
{
"name": "FederationServlet",
"type": "org.forgerock.openig.saml.FederationServlet",
"config": {
"assertionMapping": {
"userName":"mail",
"password":"employeenumber"
},
"subjectMapping":"subjectName",
"redirectURI":"/register",
"logoutURI":"/register/logout"
}
},
{
"name": "HandlerServlet",
"comment": "Entry point that transforms Servlet request to handler request.",
"type": "HandlerServlet",
"config": {
"handler": "DispatchHandler",
"baseURI":"http://www.plataformaciapem.org.mx"
}
},
{
"name": "DispatchHandler",
"type": "DispatchHandler",
"config": {
"bindings": [
{
"condition": "${exchange.request.uri.path != '/register/'}",
"handler": "ClientHandler"
},
{
"condition": "${empty exchange.session.userName}",
"handler": "SPInitiatedSSORedirectHandler",
},
{
"handler": "LoginChain",
},
]
}
},
{
"name": "SPInitiatedSSORedirectHandler",
"type": "StaticResponseHandler",
"config": {
"status": 302,
"reason": "Found",
"headers": {
"Location": ["http://www.plataformaciapem.org.mx/saml/SPInitiatedSSO"]
}
}
},
{
"name": "LoginChain",
"type": "Chain",
"config": {
"filters": ["SwitchFilter", "HiddenValueExtract"],
"handler": "OutgoingChain"
}
},
{
"name": "HiddenValueExtract",
"type": "EntityExtractFilter",
"config": {
"messageType": "response",
"target": "${exchange.hiddenValue}",
"bindings": [
{
"key": "time",
"pattern": "time\"\s.*value=\"(.{10})\"",
"template": "$1"
},
{
"key": "tokenId",
"pattern": "token_id\"\s.*value=\"(.{3})\"",
"template": "$1"
},
{
"key": "hash",
"pattern": "hash\"\s.*value=\"(.*)\"",
"template": "$1"
}
]
}
},
{
"name": "SwitchFilter",
"type": "SwitchFilter",
"config": {
"onResponse": [
{
"condition": "${exchange.response.status == 200}",
"handler": "LoginRequestHandler"
}
]
}
},
{
"name": "LoginRequestHandler",
"type": "Chain",
"config": {
"filters": ["LoginRequest"],
"handler": "OutgoingChain"
}
},
{
"name": "LoginRequest",
"type": "StaticRequestFilter",
"config": {
"method": "POST",
"uri": "http://www.plataformaciapem.org.mx/register/",
"form": {
"form:mode": ["edit"],
"form:id": ["login"],
"__confirmed_p": ["0"],
"__refreshing_p": ["0"],
"return_url": ["/dotlrn/control-panel"],
"time": ["${exchange.hiddenValue.time}"],
"token_id": ["${exchange.hiddenValue.tokenId}"],
"hash": ["${exchange.hiddenValue.hash}"]
"email": ["${exchange.session.userName}"],
"password": ["${exchange.session.password}"],
}
"headers": {
"cookie": ["${exchange.response.headers['Set-Cookie'][0]}"],
}
}
},
{
"name": "OutgoingChain",
"type": "Chain",
"config": {
"filters": ["CaptureFilter"],
"handler": "ClientHandler"
}
},
{
"name": "CaptureFilter",
"type": "CaptureFilter",
"config": {
"captureEntity": false,
"file": "/tmp/gateway.log",
}
},
{
"name": "ClientHandler",
"comment": "Responsible for sending all requests to remote servers.",
"type": "ClientHandler",
"config": {
}
}
]
},
"servletObject": "DispatchServlet",
}