Question

我有一个SimpleSamlPHP实现作为服务提供者，因此工作流程如下：

IdP将断言发送到我的ACS网址：

/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp

然后看起来他认证并被重定向到

/simplesaml/module.php/saml/sp/saml2-acs.php

抛出错误，因为没有指定authsource（/ default-sp部分）：

SimpleSAML_Error_Error: UNHANDLEDEXCEPTION
Backtrace:
0 *\simplesamlphp\www\module.php:180 (N/A)
Caused by: SimpleSAML_Error_Exception: No authentication source with id false found.
    Backtrace:
    2 *\simplesamlphp\lib\SimpleSAML\Auth\Source.php:242 (SimpleSAML_Auth_Source::getById)
    1 *\simplesamlphp\modules\saml\www\sp\saml2-acs.php:8 (require)
    0 *\simplesamlphp\www\module.php:135 (N/A)

但是，它也有一组PHP错误输出到页面：

Warning: array_key_exists(): The first argument should be either a string or an integer in *\simplesamlphp\lib\SimpleSAML\Configuration.php on line 314 
Warning: Cannot modify header information - headers already sent by (output started at *\simplesamlphp\lib\SimpleSAML\Configuration.php:314) in *\simplesamlphp\lib\SimpleSAML\Error\Error.php on line 191 
Warning: Cannot modify header information - headers already sent by (output started at *\simplesamlphp\lib\SimpleSAML\Configuration.php:314) in *\simplesamlphp\templates\includes\header.php on line 40

（我已取出目录路径并替换为* - 通常不是这样）

如果它是SimpleSamlPHP的错误，或者它（更可能是）错误的设置，我无法解决。我的authsources和元数据如下：

saml20-IDP-remote.php：

$metadata['https://app.onelogin.com/saml/metadata/391645'] = array(
    'name' => 'FSSO',
    'SingleSignOnService' => 'https://app.onelogin.com/trust/saml2/http-post/sso/391645',
    'AssertionConsumerservice' => 'https://www.fbjni.com/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp',
    'SingleLogoutService' => 'https://www.fbjni.com/simplesaml/module.php/saml/sp/saml2-logout.php/default-sp',
    'certData'          => '[rawCertificateData]'
);

authsources.php：

'default-sp' => array(
    'saml:SP',
    'RelayState' => 'https://www.fbjni.com/',
    'entityID' => 'https://app.onelogin.com/saml/metadata/391645',
),

Answer 1

您的IdP元数据可能存在一些问题。 SimpleSAMLphp包含一个元数据解析器，它将IdP配置细节转换为SimpleSAMLphp所需的格式。 SimpleSAMLphp文档中简要提到了此功能：https://simplesamlphp.org/docs/1.8/simplesamlphp-sp#section_2

根据您上面的示例，您应该能够访问https://www.fbjni.com/simplesaml/admin/metadata-converter.php处的元数据解析器。

在上面的特定示例中，从https://app.onelogin.com/saml/metadata/391645下载OneLogin元数据，并将此XML复制到SimpleSAMLphp安装中的元数据解析器中。

转换元数据后，将上面的现有IdP配置替换为元数据解析器的输出，该输出看起来应该更像：

$metadata['https://app.onelogin.com/saml/metadata/391645'] = array (
  'entityid' => 'https://app.onelogin.com/saml/metadata/391645',
  'contacts' => 
  array (
    0 => 
    array (
      'contactType' => 'technical',
      'surName' => 'Support',
      'emailAddress' => 
      array (
        0 => 'support@onelogin.com',
      ),
    ),
  ),
  'metadata-set' => 'saml20-idp-remote',
  'SingleSignOnService' => 
  array (
    0 => 
    array (
      'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
      'Location' => 'https://app.onelogin.com/trust/saml2/http-post/sso/391645',
    ),
    1 => 
    array (
      'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
      'Location' => 'https://app.onelogin.com/trust/saml2/http-post/sso/391645',
    ),
    2 => 
    array (
      'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:SOAP',
      'Location' => 'https://app.onelogin.com/trust/saml2/soap/sso/391645',
    ),
  ),
  'SingleLogoutService' => 
  array (
  ),
  'ArtifactResolutionService' => 
  array (
  ),
  'keys' => 
  array (
    0 => 
    array (
      'encryption' => false,
      'signing' => true,
      'type' => 'X509Certificate',
      'X509Certificate' => 'MIIEJjCCAw6gAwIBAgIUHyryf8tYCgBMvr2nihtEA3NFrQEwDQYJKoZIhvcNAQEF
BQAwXTELMAkGA1UEBhMCVVMxFjAUBgNVBAoMDUZhY2Vib29rIFRlc3QxFTATBgNV
BAsMDE9uZUxvZ2luIElkUDEfMB0GA1UEAwwWT25lTG9naW4gQWNjb3VudCA0MDA1
ODAeFw0xNDAzMjYwMzA2NDNaFw0xOTAzMjcwMzA2NDNaMF0xCzAJBgNVBAYTAlVT
MRYwFAYDVQQKDA1GYWNlYm9vayBUZXN0MRUwEwYDVQQLDAxPbmVMb2dpbiBJZFAx
HzAdBgNVBAMMFk9uZUxvZ2luIEFjY291bnQgNDAwNTgwggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQDjmCU+PbTPgsjgffG2cqTBzVTYOx80L07ZO2tGaqry
oCXJctP9fEcFleamose/+mg052wxStd84FpHwa2JC7sbHNeMIaBbA3b1XzFgNVJy
D2KjJK17ftYTm8EprtDPuCiMyHI3P2XGuz+i9BonxhUodgITa9FELqKAJU1GKtsJ
r4saGVlpYZgU9InYlGNohdkFfkbPSRiUeQoRhKYtYmM74maL7aGdXvSyXmUaa+n6
rl6MTMUCJj8tfs2CwqT1Ktc1wZTBRWUXcxi/02IP9AVXghhLcE1ES1tFV58FsvNN
Dtpigg9PFnRwAoC0HSMVEYh3VBx+TROqyGmM74i1yJGvAgMBAAGjgd0wgdowDAYD
VR0TAQH/BAIwADAdBgNVHQ4EFgQU11p7PgInyRe7dHHUQMrbBfka8+cwgZoGA1Ud
IwSBkjCBj4AU11p7PgInyRe7dHHUQMrbBfka8+ehYaRfMF0xCzAJBgNVBAYTAlVT
MRYwFAYDVQQKDA1GYWNlYm9vayBUZXN0MRUwEwYDVQQLDAxPbmVMb2dpbiBJZFAx
HzAdBgNVBAMMFk9uZUxvZ2luIEFjY291bnQgNDAwNTiCFB8q8n/LWAoATL69p4ob
RANzRa0BMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQUFAAOCAQEAv9Cwtv6V
ov6heh5b/u+hsFk9Lhva/jzOgbYAblWxDTgsvcehbYeZSO3XTqq5I3qx9XCqet4a
FdUetFMPk/cpcl9GahHhagvScn+ClbHVnrakRt/1/oDcrxi+6l+GT7yzg7MPoj6C
AIjmVdPhbWRiU3on6PkG95pfDq/hasCTHS3kVUJlv+Ge2rdiiIyVJmlak24UQVuN
2DznvY5jlUOIXXtCTLttu7YY5z9V0pSa0MdWDL3/mokGIjydR2DdHfkgyk2syjny
4+9ohie+oLKz1rv9OcAv+90WAYaltDoTSMYSG9W2rjeDh2NHYFuWxXOi08FPZfXo
DFLPLA0yYeSkFA==',
    ),
  ),
);

此外，您应该对authsources.php配置进行一些更改。＆＃39; entityID＆＃39;您的SP通常是您的应用程序的URL，而不是您选择的IdP的标识符。您可以为SP指定默认IdP，如下所示：

'default-sp' => array(
    'saml:SP',
    'entityID' => 'https://www.fbjni.com/',
    'RelayState' => 'https://www.fbjni.com/',
    'idp' => 'https://app.onelogin.com/saml/metadata/391645'
),

SimpleSamlPhp作为SP重定向错误

1 个答案: