SSO 和 SAML - 多个服务提供商
[英]SSO and SAML - Multiple Services Providers
问题描述
I have two Spring Boot application secured with Spring Security SAML extension.
我有两个使用 Spring Security SAML 扩展保护的 Spring Boot 应用程序。 The two applications are already running.这两个应用程序已经在运行。 The first one (web-ui-app) is an user interface to the second one (services-app), a REST API.第一个 (web-ui-app) 是第二个 (services-app) 的用户界面，一个 REST API。
After successfully access web-ui-app, correctly authenticated by the identity provider, I try to access some services-app's methods.在成功访问 web-ui-app 并通过身份提供商正确验证后，我尝试访问一些 services-app 的方法。
However, instead of receiving the correct response from services-app, a JSON response, I receive something like this:但是，我收到的不是来自 services-app 的正确响应，而是一个 JSON 响应：
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<body onload="document.forms[0].submit()">
<noscript>
<p>
<strong>Note:</strong> Since your browser does not support JavaScript, you must press the Continue button once to proceed.
</p>
</noscript>
<form action="https://ServiceProvider.com/SAML/SLO/Browser" method="post">
<div>
<input type="hidden" name="RelayState" value="0043bfc1bc45110dae17004005b13a2b"/>
<input type="hidden" name="SAMLRequest" value="PHNhbWxwOkxvZ291dFJlcXVlc3QgeG1sbnM6c2FtbHA9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpwcm90b2NvbCIgeG1sbnM9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iDQogICAgSUQ9ImQyYjdjMzg4Y2VjMzZmYTdjMzljMjhmZDI5ODY0NGE4IiBJc3N1ZUluc3RhbnQ9IjIwMDQtMDEtMjFUMTk6MDA6NDlaIiBWZXJzaW9uPSIyLjAiPg0KICAgIDxJc3N1ZXI+aHR0cHM6Ly9JZGVudGl0eVByb3ZpZGVyLmNvbS9TQU1MPC9Jc3N1ZXI+DQogICAgPE5hbWVJRCBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpuYW1laWQtZm9ybWF0OnBlcnNpc3RlbnQiPjAwNWEwNmUwLWFkODItMTEwZC1hNTU2LTAwNDAwNWIxM2EyYjwvTmFtZUlEPg0KICAgIDxzYW1scDpTZXNzaW9uSW5kZXg+MTwvc2FtbHA6U2Vzc2lvbkluZGV4Pg0KPC9zYW1scDpMb2dvdXRSZXF1ZXN0Pg=="/>
</div>
<noscript>
<div>
<input type="submit" value="Continue"/>
</div>
</noscript>
</form>
</body>
</html>
This is an SSO conversation.这是 SSO 对话。 Isn't it suppose to be a transparent key exchange between services-app and the service provider, since I'm already logged in by web-ui-app?因为我已经通过 web-ui-app 登录，所以它不是应该是 services-app 和服务提供商之间的透明密钥交换吗？
What am I missing?我错过了什么？
1 个解决方案
解决方案1
2 已采纳 2016-08-11 12:25:41
SAML can be used to secure a single application with a rest API, however, having a separate front end and back end that don't share an application or session context does not work. SAML 可用于通过 rest API 保护单个应用程序，但是，具有不共享应用程序或会话上下文的单独前端和后端不起作用。 For instance, if you have a single application with the front end packaged in and configure it as a single service provider, the session will be valid for back end API requests.例如，如果您有一个包含前端的单个应用程序并将其配置为单个服务提供者，则会话将对后端 API 请求有效。
That being said, if you keep the front end configured as a service provider, you can use stateless token based security for the REST API as you've mentioned.话虽如此，如果您将前端配置为服务提供者，您可以像您提到的那样为 REST API 使用基于无状态令牌的安全性。 This architecture is preferred because it better than sessions.这种架构是首选，因为它比会话更好。 Any request should be able to go to any instance of the REST API and be handled, thus you can add or remove instances of the API to scale the application as needed.任何请求都应该能够转到 REST API 的任何实例并得到处理，因此您可以添加或删除 API 实例以根据需要扩展应用程序。
JSON Web Tokens (JWT) is an good option as it allows you to store some information about the user in custom claims within the token. JSON Web Tokens (JWT)是一个不错的选择，因为它允许您在令牌内的自定义声明中存储有关用户的一些信息。 If all instances of the rest API sign the tokens with the same shared secret, any request can go to any instance and that instance will be able to decode the token and get the claim information (such as user id), without having to store it in an in memory cache or database.如果其余 API 的所有实例都使用相同的共享密钥对令牌进行签名，则任何请求都可以发送到任何实例，并且该实例将能够解码令牌并获取声明信息（例如用户 ID），而无需存储它在内存缓存或数据库中。
声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.