SP 发起的 SSO 和 IDP 发起的 SSO 之间的 SAML 响应差异

Question

如何从 SAML 响应中判断它是 SP 发起的 SSO 还是 IDP 发起的 SSO？是否有一个属性可以告诉我谁发起了 SSO？

例如在这个 StackOverflow 问题中：Differences between SP initiated SSO and IDP initiated SSO 他们讨论了差异，但他们没有讨论 XML 级别本身......

SAML 响应如下所示：

<samlp:Response xmlns:samlp ="urn:oasis:names:tc:SAML:2 .0 :protocol" Destination ="http: //my - sp . com /sso /saml" ID ="_45307c23795120" IssueInstant ="2014 -03 -07 T08:30:00Z" Version ="2.0">
    <saml:Issuer xmlns:saml ="urn:oasis:names:tc:SAML:2 .0 :assertion">http: //my - idp . com </saml:Issuer>
    <samlp:Status>
        <samlp:StatusCode Value ="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </samlp:Status>
    <saml:Assertion ID ="ebe015e8be2a" IssueInstant="2014-03-07T08:30:00Z" Version ="2.0">
        <saml:Issuer> http: //my - idp . com </saml:Issuer>
        <ds:Signature xmlns:ds ="http: //www . w3 . org /2000/09/xmldsig #">
            <ds:SignedInfo>
                <ds:CanonicalizationMethod Algorithm ="http: //www . w3 . org /2001/10/xml - exc - c14n #"/>
                <ds:SignatureMethod Algorithm ="http: //www . w3 . org /2000/09/ xmldsig # rsa - sha1"/>
                <ds:Reference URI ="# ebe015e8be2a">
                    <ds:Transforms>
                        <ds:Transform Algorithm ="http: //www . w3 . org /2000/09/ xmldsig # enveloped - signature"/>
                        <ds:Transform Algorithm ="http: //www . w3 . org /2001/10/xml - exc - c14n #"/>
                    </ds:Transforms>
                    <ds:DigestMethod Algorithm ="http: //www . w3 . org /2000/09/ xmldsig # sha1"/>
                    <ds:DigestValue> ... </ds:DigestValue>
                </ds:Reference>
            </ds:SignedInfo>
            <ds:SignatureValue> ... </ds:SignatureValue>
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate> ... </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </ds:Signature>
        <saml:Subject>
            <saml:NameID Format ="urn:oasis:names:tc:SAML:2 .0 :nameid - format:persistent" NameQualifier ="http: //my - idp . com" SPNameQualifier ="http: //my - sp . com /sso /saml"> NDSUser </saml:NameID>
            <saml:SubjectConfirmation Method ="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml:SubjectConfirmationData NotOnOrAfter ="2014 -03 -07 T10:45:00Z" Recipient ="http: //my - sp . com /sso /saml"/>
            </saml:SubjectConfirmation>
        </saml:Subject>
        <saml:Conditions NotBefore ="2014 -03 -07 T08:29:00Z" NotOnOrAfter="2014 -03 -07 T10:46:00Z">
            <saml:AudienceRestriction>
                <saml:Audience> http: //my - sp . com /sso /saml </saml:Audience>
            </saml:AudienceRestriction>
        </saml:Conditions>
        <saml:AuthnStatement AuthnInstant="2014 -03 -07 T08:25:56Z" SessionIndex="f7810a8c86a6">
            <saml:AuthnContext>
                <saml:AuthnContextClassRef> urn:oasis:names:tc:SAML:2 .0:ac:classes:PasswordProtectedTransport </saml:AuthnContextClassRef>
            </saml:AuthnContext>
        </saml:AuthnStatement>
        <saml:AttributeStatement>
            <saml:Attribute Name ="FEDERATION_ID">
                <saml:AttributeValue xmlns:xs ="http: //www . w3 . org /2001/XMLSchema" xmlns:xsi ="http: //www . w3 . org /2001/XMLSchema - instance" xsi:type ="xs:string"> NDS </saml:AttributeValue>
            </saml:Attribute>
        </saml:AttributeStatement>
    </saml:Assertion>
</samlp:Response>

Answer 1

来自 SP 发起的 SSO 流的 SAML 响应具有“InResponseTo”属性。