spring-saml - SP元数据文件在使用自签名和CA颁发的证书时有何区别？

我们有一个SAML设置，它在SP元数据文件上使用自签名证书，但当我将其更改为CA颁发的证书时，Spring SAML会抱怨它无法识别签名证书的算法。所以我想知道SP元数据文件本身的格式是否会改变？我们是否也应该在spring setup中对securityContext.xml进行任何更改？

我已成功将CA颁发的证书导入密钥库。作为扩展元数据的一部分，我确实提到了要使用的正确签名和加密别名。

我尝试过的SP元数据文件更改的摘录 ... zev7iEYUkjO8ESb + SM + kmcsoXzF6r8ddVAR03 + DWoca8jJWm + 6Gh2NNffnM4yXJa mbGgiPpC2nyThvDCHIj2J32p CN = GeoTrust SSL CA，O =＆＃34; GeoTrust，Inc。＆＃34;，C = US CN = mydmainname.com， O =公司，L =纽约，ST =纽约，C = US， SERIALNUMBER = 1234

请参阅以下例外

javax.servlet.ServletException：org.opensaml.ws.message.encoder.MessageEncodingException：签名凭证的算法无法导出ithm URI 在org.springframework.security.saml.SAMLEntryPoint.commence（SAMLEntryPoint.java:164）在com.mae.service.saml.SAMLEngine.sendAuthenticationRequest（SAMLEngine.java:45）在com.mae.frontend.action.saml.SAMLRequestAction.execute（SAMLRequestAction.java:69）在com.mae.frontend.framework.request.Action._processAction（Action.java:94）在com.mae.frontend.framework.request.Action.processAction（Action.java:74）在com.mae.frontend.framework.request.ControllerServlet._doPost（ControllerServlet.java:175）在com.mae.frontend.framework.request.ControllerServlet.doPost（ControllerServlet.java:107）在javax.servlet.http.HttpServlet.service（HttpServlet.java:710）在javax.servlet.http.HttpServlet.service（HttpServlet.java:803）在org.apache.catalina.core.ApplicationFilterChain.internalDoFilter（ApplicationFilterChain.java:290）在org.apache.catalina.core.ApplicationFilterChain.doFilter（ApplicationFilterChain.java:206）在com.mae.perf.web.filter.HttpCompressionFilter._doFilter（HttpCompressionFilter.java:62）在com.mae.perf.web.filter.HttpCompressionFilter.doFilter（HttpCompressionFilter.java:44）在org.apache.catalina.core.ApplicationFilterChain.internalDoFilter（ApplicationFilterChain.java:235）在org.apache.catalina.core.ApplicationFilterChain.doFilter（ApplicationFilterChain.java:206）在com.mae.i18n.ILContextFilter.doFilter（ILContextFilter.java:39）在org.apache.catalina.core.ApplicationFilterChain.internalDoFilter（ApplicationFilterChain.java:235）在org.apache.catalina.core.ApplicationFilterChain.doFilter（ApplicationFilterChain.java:206）在com.mae.pmon.xt.http.HttpCallFilter._doFilter（HttpCallFilter.java:54）在com.mae.pmon.xt.http.HttpCallFilter.doFilter（HttpCallFilter.java:38）在org.apache.catalina.core.ApplicationFilterChain.internalDoFilter（ApplicationFilterChain.java:235）在org.apache.catalina.core.ApplicationFilterChain.doFilter（ApplicationFilterChain.java:206）在org.apache.catalina.core.StandardWrapperValve.invoke（StandardWrapperValve.java:230）在org.apache.catalina.core.StandardContextValve.invoke（StandardContextValve.java:175）在org.apache.catalina.core.StandardHostValve.invoke（StandardHostValve.java:128）在org.apache.catalina.valves.ErrorReportValve.invoke（ErrorReportValve.java:104）在org.apache.catalina.core.StandardEngineValve.invoke（StandardEngineValve.java:109）在org.apache.catalina.connector.CoyoteAdapter.service（CoyoteAdapter.java:261）在org.apache.coyote.http11.Http11Processor.process（Http11Processor.java:844）在org.apache.coyote.http11.Http11Protocol $ Http11ConnectionHandler.process（Http11Protocol.java:581）在org.apache.tomcat.util.net.JIoEndpoint $ Worker.run（JIoEndpoint.java:447）在java.lang.Thread.run（Thread.java:722）引起：org.opensaml.ws.message.encoder.MessageEncodingException：签名凭证的算法URI不能是派生 at org.opensaml.saml2.binding.encoding.HTTPRedirectDeflateEncoder.getSignatureAlgorithmURI（HTTPRedirectDeflateEncoder.j） AVA：223） at org.opensaml.saml2.binding.encoding.HTTPRedirectDeflateEncoder.buildRedirectURL（HTTPRedirectDeflateEncoder.java:188） at org.opensaml.saml2.binding.encoding.HTTPRedirectDeflateEncoder.doEncode（HTTPRedirectDeflateEncoder.java:104）在org.opensaml.ws.message.encoder.BaseMessageEncoder.encode（BaseMessageEncoder.java:52）在org.springframework.security.saml.processor.SAMLProcessorImpl.sendMessage（SAMLProcessorImpl.java:224）在org.springframework.security.saml.processor.SAMLProcessorImpl.sendMessage（SAMLProcessorImpl.java:192）在org.springframework.security.saml.websso.AbstractProfileBase.sendMessage（AbstractProfileBase.java:148）在org.springframework.security.saml.websso.WebSSOProfileImpl.sendAuthenticationRequest（WebSSOProfileImpl.java:105）在org.springframework.security.saml.SAMLEntryPoint.initializeSSO（SAMLEntryPoint.java:226）在org.springframework.security.saml.SAMLEntryPoint.commence（SAMLEntryPoint.java:153） ......还有31个感谢您的帮助。

SP元数据文件在使用自签名和CA颁发的证书时有何区别？

1 个答案: