如何验证 SAML 断言签名答案

【问题标题】：How to validate SAML assertion signatures如何验证 SAML 断言签名
【发布时间】：2018-08-22 03:10:21
【问题描述】：

如何验证 SAML 断言签名？

    for (Assertion assertion : samlResponse.getAssertions()) {
        try {
            if (assertion.getSignature() != null) {
                Optional<X509Certificate> x509Certificate = assertion.getSignature().getKeyInfo().getX509Datas()
                        .stream()
                        .findFirst()
                        .map(x509Data -> x509Data.getX509Certificates()
                                .stream()
                                .findFirst()
                                .orElse(null)
                        );
                if (x509Certificate.isPresent()) {
                    BasicX509Credential credential = new BasicX509Credential();
                    credential.setEntityCertificate(KeyInfoHelper.getCertificate(x509Certificate.get()));
                    // what pub key credential to use here?
                    SignatureValidator validator = new SignatureValidator(credential);
                    validator.validate(assertion.getSignature());
                }
            }
        } catch (ValidationException | CertificateException e) {
            throw new SAMLException(e.getMessage(), e);
        }
    }

基本上在new SignatureValidator(credential)里面放什么

据我了解，提供 KeyInfo 和 X809 证书的 SAML 断言至少应该验证 (SAML: Why is the certificate within the Signature?)

我还有一个来自 idps 元数据的 x509 证书，我猜如果断言中或信任链中没有 x509 证书（？），则通常应该使用它

基本上，断言中的 x509 证书和 idp 元数据中的证书似乎都不起作用。我在这里想念什么？

【问题讨论】：

标签： saml x509certificate signature xml-signature opensaml

【解决方案1】：

事实证明我做的一切都是正确的。

当打印一个opensaml对象xml时，你不应该使用下面的代码：

public static String xmlObjectToString(XMLObject xmlObject) {
    try {
        Marshaller marshaller = Configuration.getMarshallerFactory().getMarshaller(xmlObject);
        StringWriter sw = new StringWriter();
        Element authDOM = marshaller.marshall(xmlObject);
        toString(sw, authDOM);
        return sw.toString();
    } catch (Exception e) {
        throw new RuntimeException(e);
    }
}


private static void toString(StringWriter rspWrt, Element authDOM) throws ParserConfigurationException, TransformerException {
    DOMSource domSource = new DOMSource(authDOM);
    StreamResult result = new StreamResult(rspWrt);
    TransformerFactory tf = TransformerFactory.newInstance();
    Transformer transformer = tf.newTransformer();
    transformer.transform(domSource, result);
}

上面的代码改变了原始对象的一些内部状态

转而去

org.opensaml.xml.util.XMLHelper.prettyPrintXML(message.getDOM())

【讨论】：