ADFS：SAML 签名验证依赖于什么

Question

我有自己的 ADFS 在线部署。

我让它信任一些 SP，例如 SAMLtest.id 在这个信任的配置过程中，我每次只填了两件事：

• The SALM ACS
• The Relying party trust identifier（SAML 颁发者）

仅此而已。没有 SP 元数据文件，只有这两条信息。然后它工作，SAMLtest.id SP 受我的 ADFS 信任，我可以执行 SSO 身份验证。 与一些内部 SP 合作也是如此。

然后每个 SP 从其元数据文件中信任我的 ADFS IdP。

但是现在我们正在开发一个基于 SAML Crewjam 库的 SP，并且发生了一个奇怪的行为。为了执行信任，我们还给 ADFS ACS 和 identifier，但显然它还需要验证 SAML 签名，因为当我尝试执行 SSO 身份验证时发生错误：

MSIS0037：找不到颁发者“https:///self-service/methods/saml/acs”的签名验证证书

错误信息很清楚，所以我 add the certificate 被 SP 用来签署 SAML 请求，现在它工作了，我可以执行 SSO 连接。

这就是我不明白的地方：为什么有些 SP 被我的 ADFS 信任而无需添加签名验证证书，而另一些则需要它？

这是 SAMLtest.id 的 SAML 请求（无需签名验证证书）：

<samlp:AuthnRequest
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    AssertionConsumerServiceURL="https://samltest.id/Shibboleth.sso/SAML2/POST"
                    Destination="https://<my_adfs_idp>/adfs/ls/"
                    ID="_22d23a57f0d6359675246083cc8faf2e"
                    IssueInstant="2022-02-22T13:45:40Z"
                    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    Version="2.0">
    <saml:Issuer
        xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://samltest.id/saml/sp
    </saml:Issuer>
    <samlp:NameIDPolicy AllowCreate="1" />
</samlp:AuthnRequest> 

这是我们基于 Crewjam 的自定义 SP 的 SAML 请求（没有签名验证证书将无法工作）：

<samlp:AuthnRequest
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    ID="id-97c753d96c1a9bcabcb4931465d9b7dcb9e35e21"
                    Version="2.0"
                    IssueInstant="2022-02-22T10:42:53.434Z"
                    Destination="https://<my_adfs_idp>/adfs/ls/"
                    AssertionConsumerServiceURL="https://<my_sp>/self-service/methods/saml/acs"
                    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    >
    <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://<my_sp>/self-service/methods/saml/acs</saml:Issuer>
    <samlp:NameIDPolicy AllowCreate="true" />
</samlp:AuthnRequest> 

编辑1：

这是通过 Get-AdfsRelyingPartyTrust 获得的一些附加信息。

对于 SAMLtestid：

AllowedAuthenticationClassReferences : {}
EncryptionCertificateRevocationCheck : CheckChainExcludeRoot
PublishedThroughProxy                : False
SigningCertificateRevocationCheck    : CheckChainExcludeRoot
WSFedEndpoint                        :
AdditionalWSFedEndpoint              : {}
ClaimsProviderName                   : {}
ClaimsAccepted                       : {}
EncryptClaims                        : True
Enabled                              : True
EncryptionCertificate                :
Identifier                           : {https://samltest.id/saml/sp}
NotBeforeSkew                        : 0
EnableJWT                            : False
AlwaysRequireAuthentication          : False
Notes                                :
OrganizationInfo                     :
ObjectIdentifier                     : 29c4b776-ff8f-ec11-8e3f-fd3950cefa56
ProxyEndpointMappings                : {}
ProxyTrustedEndpoints                : {}
ProtocolProfile                      : WsFed-SAML
RequestSigningCertificate            : {}
EncryptedNameIdRequired              : False
SignedSamlRequestsRequired           : False
SamlEndpoints                        : {Microsoft.IdentityServer.Management.Resources.SamlEndpoint}
SamlResponseSignature                : AssertionOnly
SignatureAlgorithm                   : http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
TokenLifetime                        : 0
AllowedClientTypes                   : Public, Confidential
IssueOAuthRefreshTokensTo            : AllDevices
RefreshTokenProtectionEnabled        : True
RequestMFAFromClaimsProviders        : False
ScopeGroupId                         :
ScopeGroupIdentifier                 :
DeviceAuthenticationMethod           :
Name                                 : SAML Test ID
AutoUpdateEnabled                    : False
MonitoringEnabled                    : False
MetadataUrl                          :
ConflictWithPublishedPolicy          : False
IssuanceAuthorizationRules           :
IssuanceTransformRules               : @RuleTemplate = "LdapClaims"
                                       @RuleName = "Send LDAP Attributes as Claims"
                                       c:[Type ==
                                       "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
                                       Issuer == "AD AUTHORITY"]
                                        => issue(store = "Active Directory", types =
                                       ("http://schemas.xmlsoap.org/claims/Group",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"), query =
                                       ";title,mail,givenName,displayName,sn,sAMAccountName;{0}", param = c.Value);


DelegationAuthorizationRules         :
LastPublishedPolicyCheckSuccessful   :
LastUpdateTime                       : 1/1/1900 1:00:00 AM
LastMonitoredTime                    : 1/1/1900 1:00:00 AM
ImpersonationAuthorizationRules      :
AdditionalAuthenticationRules        :
AccessControlPolicyName              : Permit everyone
AccessControlPolicyParameters        :
ResultantPolicy                      : RequireFreshAuthentication:False
                                       IssuanceAuthorizationRules:
                                       {
                                         Permit everyone
                                       }

对于我基于 Crewjam 的 SP（在我添加证书之前）：

AllowedAuthenticationClassReferences : {}
EncryptionCertificateRevocationCheck : CheckChainExcludeRoot
PublishedThroughProxy                : False
SigningCertificateRevocationCheck    : CheckChainExcludeRoot
WSFedEndpoint                        :
AdditionalWSFedEndpoint              : {}
ClaimsProviderName                   : {}
ClaimsAccepted                       : {}
EncryptClaims                        : True
Enabled                              : True
EncryptionCertificate                :
Identifier                           : {https://samltest.id/saml/sp}
NotBeforeSkew                        : 0
EnableJWT                            : False
AlwaysRequireAuthentication          : False
Notes                                :
OrganizationInfo                     :
ObjectIdentifier                     : 29c4b776-ff8f-ec11-8e3f-fd3950cefa56
ProxyEndpointMappings                : {}
ProxyTrustedEndpoints                : {}
ProtocolProfile                      : WsFed-SAML
RequestSigningCertificate            : {}
EncryptedNameIdRequired              : False
SignedSamlRequestsRequired           : False
SamlEndpoints                        : {Microsoft.IdentityServer.Management.Resources.SamlEndpoint}
SamlResponseSignature                : AssertionOnly
SignatureAlgorithm                   : http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
TokenLifetime                        : 0
AllowedClientTypes                   : Public, Confidential
IssueOAuthRefreshTokensTo            : AllDevices
RefreshTokenProtectionEnabled        : True
RequestMFAFromClaimsProviders        : False
ScopeGroupId                         :
ScopeGroupIdentifier                 :
DeviceAuthenticationMethod           :
Name                                 : SAML Test ID
AutoUpdateEnabled                    : False
MonitoringEnabled                    : False
MetadataUrl                          :
ConflictWithPublishedPolicy          : False
IssuanceAuthorizationRules           :
IssuanceTransformRules               : @RuleTemplate = "LdapClaims"
                                       @RuleName = "Send LDAP Attributes as Claims"
                                       c:[Type ==
                                       "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
                                       Issuer == "AD AUTHORITY"]
                                        => issue(store = "Active Directory", types =
                                       ("http://schemas.xmlsoap.org/claims/Group",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
                                       "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"), query =
                                       ";title,mail,givenName,displayName,sn,sAMAccountName;{0}", param = c.Value);


DelegationAuthorizationRules         :
LastPublishedPolicyCheckSuccessful   :
LastUpdateTime                       : 1/1/1900 1:00:00 AM
LastMonitoredTime                    : 1/1/1900 1:00:00 AM
ImpersonationAuthorizationRules      :
AdditionalAuthenticationRules        :
AccessControlPolicyName              : Permit everyone
AccessControlPolicyParameters        :
ResultantPolicy                      : RequireFreshAuthentication:False
                                       IssuanceAuthorizationRules:
                                       {
                                         Permit everyone
                                       }

您可以看到这两种配置之间没有什么不同，除了 Identifier、ObjectIdentifier 和 Name。

SignedSamlRequestsRequired 在这两种情况下都是 False。

编辑2：

这是提供给 SP 的 ADFS IdP 元数据文件。由于 ADFS 元数据文件非常大，这里有一个简化版本，结果完全相同（为了更清晰，隐藏了证书）：

<?xml version="1.0"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2022-02-24T13:41:36Z" cacheDuration="PT1646142096S" entityID="http://<my_adfs_idp>/adfs/services/trust">
  <md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <md:KeyDescriptor use="signing">
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
          <ds:X509Certificate>...</ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>
    <md:KeyDescriptor use="encryption">
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
          <ds:X509Certificate>...</ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>
    <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://<my_adfs_idp>/adfs/ls/"/>
  </md:IDPSSODescriptor>
</md:EntityDescriptor>

这是 SP 元数据文件（出于同样的原因，证书也被隐藏），但没有提供给 ADFS IdP，因为它只需要 ACS 和 Identifier 值（有时还有签名验证证书，这是我的问题）：

<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2022-02-26T10:50:18.198Z" entityID="https://<my_sp>/self-service/methods/saml/acs">
  <SPSSODescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2022-02-26T10:50:18.198103727Z" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="true" WantAssertionsSigned="true">
    <KeyDescriptor use="encryption">
      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
        <X509Data xmlns="http://www.w3.org/2000/09/xmldsig#">
          <X509Certificate xmlns="http://www.w3.org/2000/09/xmldsig#">...</X509Certificate>
        </X509Data>
      </KeyInfo>
      <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"></EncryptionMethod>
      <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes192-cbc"></EncryptionMethod>
      <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"></EncryptionMethod>
      <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"></EncryptionMethod>
    </KeyDescriptor>
    <KeyDescriptor use="signing">
      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
        <X509Data xmlns="http://www.w3.org/2000/09/xmldsig#">
          <X509Certificate xmlns="http://www.w3.org/2000/09/xmldsig#">...</X509Certificate>
        </X509Data>
      </KeyInfo>
    </KeyDescriptor>
    <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://<my_sp>:4455/saml/slo" ResponseLocation="https://<my_sp>:4455/saml/slo"></SingleLogoutService>
    <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://<my_sp>/self-service/methods/saml/acs" index="1"></AssertionConsumerService>
    <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://<my_sp>/self-service/methods/saml/acs" index="2"></AssertionConsumerService>
  </SPSSODescriptor>
</EntityDescriptor> 

Answer 1

无论哪种方式，您都可以configure SP。

[-SignedSamlRequestsRequired <Boolean>]