Question

我的IDP需要一个带有嵌入式，签名和加密的AuthNRequest，其中请求网址如下所示：

http://idp.example.com/SSOService.php?SAMLRequest= {val1}

带嵌入式签名的AuthNRequest（HTTP-POST绑定）

reversed

但是我的请求看起来像是

http://idp.example.com/SSOService.php?SAMLRequest= {val1}＆amp; Signature = {val2}＆amp; SigAlg = {val3}

在 OneLogin＆＃39; s [php-saml] 中，我的设置需要对邮件进行签名和加密

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="pfx41d8ef22-e612-8c50-9960-1b16f15741b3" Version="2.0" ProviderName="SP test" IssueInstant="2014-07-16T23:52:45Z" Destination="http://idp.example.com/SSOService.php" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="http://sp.example.com/demo1/index.php?acs">
  <saml:Issuer>http://sp.example.com/demo1/metadata.php</saml:Issuer>
  <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:SignedInfo>
      <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
      <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
      <ds:Reference URI="#pfx41d8ef22-e612-8c50-9960-1b16f15741b3">
        <ds:Transforms>
          <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
          <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
        </ds:Transforms>
        <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
        <ds:DigestValue>yJN6cXUwQxTmMEsPesBP2NkqYFI=</ds:DigestValue>
      </ds:Reference>
    </ds:SignedInfo>
    <ds:SignatureValue>...</ds:SignatureValue>
    <ds:KeyInfo>
      <ds:X509Data>
        <ds:X509Certificate>...</ds:X509Certificate>
      </ds:X509Data>
    </ds:KeyInfo>
  </ds:Signature>
  <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" AllowCreate="true"/>
  <samlp:RequestedAuthnContext Comparison="exact">
    <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
  </samlp:RequestedAuthnContext>
</samlp:AuthnRequest>

并在 SimpleSAMLphp 中我的idp-remote config

'nameIdEncrypted' => true,
'authnRequestsSigned' => true,
'logoutRequestSigned' => true,
'logoutResponseSigned' => true,
'signMetadata' => true,
'wantMessagesSigned' => true,
'wantAssertionsSigned' => true,'wantAssertionsEncrypted' => true,
'wantNameIdEncrypted' => true,
'requestedAuthnContext' => true,
'wantXMLValidation' => true,
'signatureAlgorithm' => 'http://www.w3.org/2000/09/xmldsig#rsa-sha1',

和我的sp配置

$metadata['https:/my.idp.com/idplogin'] = array(
        'name' => array(
                'en' => 'my.idp.com',
                'no' => 'my.idp.com',
        ),
        'description'          => 'IDP SSO',
        'sign.authnrequest' => TRUE,
        'sign.logout' => TRUE,
        'signature.algorithm' => 'http://www.w3.org/2000/09/xmldsig#rsa-sha1',
        'assertion.encryption' => TRUE,
        'sharedkey' => 'SHAREDKEY.crt',
          'SingleLogoutService' =>
          array (
            0 =>
            array (
              'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
              'Location' => 'http://iam.sp.com/module.php/saml/sp/saml2-logout.php/default-sp',
            ),
          ),
          'AssertionConsumerService' =>
          array (
            0 =>
            array (
              'index' => 0,
              'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
              'Location' => 'http://iam.sp.com/module.php/saml/sp/saml2-acs.php/default-sp',
            ),
            1 =>
            array (
              'index' => 1,
              'Binding' => 'urn:oasis:names:tc:SAML:1.0:profiles:browser-post',
              'Location' => 'http://iam.sp.com/module.php/saml/sp/saml1-acs.php/default-sp',
            ),
            2 =>
            array (
              'index' => 2,
              'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact',
              'Location' => 'http://iam.sp.com/module.php/saml/sp/saml2-acs.php/default-sp',
            ),
            3 =>
            array (
              'index' => 3,
              'Binding' => 'urn:oasis:names:tc:SAML:1.0:profiles:artifact-01',
              'Location' => 'http://iam.sp.com/module.php/saml/sp/saml1-acs.php/default-sp/artifact',
            ),
          ),
        'SingleSignOnService' => 'https:/my.idp.com/samljct',
        'redirect.sign' => TRUE,
        'redirect.validate' => TRUE,
        'acs.Bindings' => array(
                'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
                'urn:oasis:names:tc:SAML:1.0:profiles:browser-post',
        ),
        'certFingerprint'      => 'FINGERPRINTED',
        'certificate'          => 'SPCERTYA.crt'
);

在这两项服务中，我不确定如何在AuthNRequest中嵌入签名？

Answer 1

更改IDP远程配置中的以下行：

'SingleSignOnService' => 'https:/my.idp.com/samljct',

为：

'SingleSignOnService' => array(
   array(
        'Location' => 'https:/my.idp.com/samljct',
        'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
    ),
),

应该有用。

如何在php中的SAML 2.0 SSO的AuthNRequest中嵌入签名

1 个答案: