使用 XML::Canonicalize XML 的前缀列表指定嵌套命名空间

Question

我（或者更确切地说，我正在使用的 Net::SAML2 库是）试图规范化 XML 并获取命名空间错误。我的印象是正确设置前缀列表的问题，但我不知道应该采用什么格式。（Net::SAML2 似乎试图生成一个列表但出现空。）示例代码：

use XML::CanonicalizeXML;

my $xml = '<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfx894bbcab-a4d3-7694-5b56-26dc207e3479" IssueInstant="2014-09-12T01:51:30Z"><saml:Issuer>http://example.com/metadata</saml:Issuer><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">bob@example.com</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2014-09-12T01:54:30Z" Recipient="{recipient}" InResponseTo="3e19c9272c04531d0c01643749e9dfda" /></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2014-09-12T01:48:30Z" NotOnOrAfter="2014-09-12T01:54:30Z"><saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2014-09-12T01:51:29Z" SessionNotOnOrAfter="2014-09-13T01:51:30Z" SessionIndex="_59f97890-1bff-0132-6393-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="first_name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Billy</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>';
my $xpath = '<XPath>(//. | //@* | //namespace::*)</XPath>';
my $prefixlist = '';
my $canon = XML::CanonicalizeXML::canonicalize($xml,$xpath,$prefixlist,1,0);

产生这些警告：

namespace error : Namespace prefix saml on Assertion is not defined
ID="pfx894bbcab-a4d3-7694-5b56-26dc207e3479" IssueInstant="2014-09-12T01:51:30Z"
                                                                               ^
namespace error : Namespace prefix saml on Issuer is not defined
ab-a4d3-7694-5b56-26dc207e3479" IssueInstant="2014-09-12T01:51:30Z"><saml:Issuer
                                                                               ^
namespace error : Namespace prefix saml on Subject is not defined
2T01:51:30Z"><saml:Issuer>http://example.com/metadata</saml:Issuer><saml:Subject
                                                                               ^
namespace error : Namespace prefix saml on NameID is not defined
ubject><saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
                                                                               ^
namespace error : Namespace prefix saml on SubjectConfirmation is not defined
:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"
                                                                               ^
namespace error : Namespace prefix saml on SubjectConfirmationData is not defined
54:30Z" Recipient="{recipient}" InResponseTo="3e19c9272c04531d0c01643749e9dfda" 
                                                                               ^
namespace error : Namespace prefix saml on Conditions is not defined
:Conditions NotBefore="2014-09-12T01:48:30Z" NotOnOrAfter="2014-09-12T01:54:30Z"
                                                                               ^
namespace error : Namespace prefix saml on AudienceRestriction is not defined
4-09-12T01:48:30Z" NotOnOrAfter="2014-09-12T01:54:30Z"><saml:AudienceRestriction
                                                                               ^
namespace error : Namespace prefix saml on Audience is not defined
0Z" NotOnOrAfter="2014-09-12T01:54:30Z"><saml:AudienceRestriction><saml:Audience
                                                                               ^
namespace error : Namespace prefix saml on AuthnStatement is not defined
fter="2014-09-13T01:51:30Z" SessionIndex="_59f97890-1bff-0132-6393-782bcb56fcaa"
                                                                               ^
namespace error : Namespace prefix saml on AuthnContext is not defined
:51:30Z" SessionIndex="_59f97890-1bff-0132-6393-782bcb56fcaa"><saml:AuthnContext
                                                                               ^
namespace error : Namespace prefix saml on AuthnContextClassRef is not defined
97890-1bff-0132-6393-782bcb56fcaa"><saml:AuthnContext><saml:AuthnContextClassRef
                                                                               ^
namespace error : Namespace prefix saml on AttributeStatement is not defined
ntextClassRef></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement
                                                                               ^
namespace error : Namespace prefix saml on Attribute is not defined
Name="first_name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
                                                                               ^
namespace error : Namespace prefix saml on AttributeValue is not defined
Value xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string"
                                                                               ^

Answer 1

你不见了

xmlns:saml="..."

价值？好像

xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"

或

xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"

从文档中urn:oasis:names:tc:SAML:2.0:...的大量实例来看，显然是后者。

Answer 2

查看：https://metacpan.org/pod/XML::Sig::OO#Working-with-Net::SAML2

pod 中的示例显示了如何解决此问题：

  use Net::SAML2::Protocol::Assertion;
    use XML::Sig::OO;
    use MIME::Base64;

    # Lets assume we have a post binding response
    my $saml_response=.....

    my $xml=decode_base64($saml_response);

    my $v=XML::Sig::OO->new(xml=>$xml,cacert=>'idp_cert.pem');
    my $result=$v->validate;
    die $result unless $result;

    # we can now use the asertion knowing it was from our idp
    my $assertion=Net::SAML2::Protocol::Assertion->new_from_xml(xml=>$xml)