Question

我尝试将标准spring saml example与本地存储的SP元数据一起使用。在验证该示例与自动生成的元数据一起正常工作后，我使用提供的指令在本地存储数据：

要永久存储元数据，请按照以下说明操作：


将元数据内容存储在您的achrive中   /WEB-INF/classes/metadata/vcdevelopmenttestrobert_sp.xml

确保使用生成的元数据更新您的身份提供商

修改bean＆＃34;元数据＆＃34;在您的securityContext.xml中包含来自的内容   上面的配置

我收到错误（触发SSO登录时）

Message:
Cannot sign outgoing message as no signing credential is set in the context 

StackTrace:
java.lang.IllegalArgumentException: Cannot sign outgoing message as no signing credential is set in the context
at org.springframework.util.Assert.notNull(Assert.java:112)
at org.springframework.security.saml.processor.SAMLProcessorImpl.sendMessage(SAMLProcessorImpl.java:222)
at ...

元数据如下所示：

 <bean id="metadata" class="org.springframework.security.saml.metadata.CachingMetadataManager">
    <constructor-arg>
        <list>
            <bean class="org.opensaml.saml2.metadata.provider.HTTPMetadataProvider">
                <constructor-arg>
                    <value type="java.lang.String">http://idp.ssocircle.com/idp-meta.xml</value>
                </constructor-arg>
                <constructor-arg>
                    <value type="int">5000</value>
                </constructor-arg>
                <property name="parserPool" ref="parserPool"/>
            </bean>
            <bean class="org.springframework.security.saml.metadata.ExtendedMetadataDelegate">
                <constructor-arg>
                    <bean class="org.opensaml.saml2.metadata.provider.ResourceBackedMetadataProvider">
                        <constructor-arg>
                            <bean class="java.util.Timer"/>
                        </constructor-arg>
                        <constructor-arg>
                            <bean class="org.opensaml.util.resource.ClasspathResource">
                                <constructor-arg value="/metadata/vcdevelopmenttestrobert_sp.xml"/>
                            </bean>
                        </constructor-arg>
                        <property name="parserPool" ref="parserPool"/>
                    </bean>
                </constructor-arg>
                <constructor-arg>
                    <bean class="org.springframework.security.saml.metadata.ExtendedMetadata">
                        <property name="local" value="true"/>
                        <property name="securityProfile" value="metaiop"/>
                        <property name="sslSecurityProfile" value="pkix"/>
                        <property name="sslHostnameVerification" value="default"/>
                        <property name="signMetadata" value="false"/>
                        <property name="signingKey" value="null"/>
                        <property name="encryptionKey" value="null"/>
                        <property name="requireArtifactResolveSigned" value="true"/>
                        <property name="requireLogoutRequestSigned" value="true"/>
                        <property name="requireLogoutResponseSigned" value="false"/>
                        <property name="idpDiscoveryEnabled" value="true"/>
                        <property name="idpDiscoveryURL" value="http://localhost:8080/saml/discovery"/>
                        <property name="idpDiscoveryResponseURL" value="http://localhost:8080/saml/login?disco=true"/>
                    </bean>
                </constructor-arg>
            </bean> 
        </list>
    </constructor-arg>
 </bean>

知道我做错了吗？

Answer 1

要回答我自己的问题：signedKey和encryptionKey应更改为：

  <property name="signingKey" value="apollo"/>
  <property name="encryptionKey" value="apollo"/>

我找到了答案here。如果元数据管理页面对此有一个提示，那就太好了。

spring saml无法签署外发邮件，因为在上下文中未设置签名凭据

1 个答案: