簽名出現在AttributeStatement（.Net 4.5）旁邊時，出現SAML 2.0錯誤

Question

我正在使用通過SAML 2.0斷言發送請求的服務運行集成測試： System.IdentityModel.Tokens.Saml2SecurityTokenHandler的ReadAssertion(XmlReader reader)方法拋出異常，而Element is an invalid XmlNodeType消息。

嘗試調查此問題，我發現這是因為該方法希望在Signature位置讀取end元素，並且如果我刪除此節點，則此方法可以正常工作，但又遇到另一個異常ID4152: The Saml2SecurityToken cannot be validated because the IssuerToken property is not set. Unsigned SAML2:Assertions cannot be validated. ID4152: The Saml2SecurityToken cannot be validated because the IssuerToken property is not set. Unsigned SAML2:Assertions cannot be validated.

有人可以幫我什么問題嗎？ 還是請求簽名的格式正確。 從我的測試應用程序中，簽名始終是第一位的，我沒有這個問題。 這是他們寄給我的。

  <saml2:Assertion xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
  xmlns:exc14n="http://www.w3.org/2001/10/xml-exc-c14n#"
  xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
  xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
  xmlns:xs="http://www.w3.org/2001/XMLSchema" ID="_3667829ea1b046968151794aa774f909"
  IssueInstant="2014-01-07T22:57:13.118Z" Version="2.0">
  <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">C=US,O=AEGISnetInc,CN=dilhn001.dil.aegis.net</saml2:Issuer>
  <saml2:Subject xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
    <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">UID=TS: PRL-R-0000.0-2010 TC: PD-R-0000.0-2010</saml2:NameID>
    <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:holder-of-key">
      <saml2:SubjectConfirmationData>
        <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
          <ds:KeyValue>
            <ds:RSAKeyValue>
              <ds:Modulus>jT0q3UTlZ7maUp5VwmVbZvIv67gm3SFJjN+2EhJtg9TEdTFkL5aQAI06uU32kdqnLPyfWElZdmgGtr6YHYfUy1K1o3wXK9jnX8JTL8oybNmDqkVw/TVXr9KD0vAw+8Iut1T7boDGdD7bnzwPBwImtyCIm6S6Q4Wlx64xkq4gdhZTXkkSaKPyy517LgNCtzdigDVU+bZqAueWE1l4BOpHVrjULX8wLGjZloU4rWqN0AvsjS1OpC0HO/aTxKznT4jD1PVNKJPLzlTU6e0RPuOMyTlccoPf2UeAMI+QZDim7uZ9IoE0dMnqJLSGYq+KGfa0AZReg1OFXYzF2qicdmFKeQ==</ds:Modulus>
              <ds:Exponent>AQAB</ds:Exponent>
            </ds:RSAKeyValue>
          </ds:KeyValue>
        </ds:KeyInfo>
      </saml2:SubjectConfirmationData>
    </saml2:SubjectConfirmation>
  </saml2:Subject>
  <saml2:AuthnStatement xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" AuthnInstant="2014-01-07T22:19:12.905Z" SessionIndex="123456">
    <saml2:AuthnContext>
      <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:X509</saml2:AuthnContextClassRef>
    </saml2:AuthnContext>
  </saml2:AuthnStatement>
  <saml2:AttributeStatement xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
    <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:subject-id">
      <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance" xmlns:ns7="http://www.w3.org/2001/XMLSchema" ns6:type="ns7:string">Lab IT Testcase</saml2:AttributeValue>
    </saml2:Attribute>
    <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:organization">
      <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance" xmlns:ns7="http://www.w3.org/2001/XMLSchema" ns6:type="ns7:string">2.16.840.1.113883.3.1259.10.1001</saml2:AttributeValue>
    </saml2:Attribute>
    <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:organization-id">
      <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance" xmlns:ns7="http://www.w3.org/2001/XMLSchema" ns6:type="ns7:string">urn:oid:2.16.840.1.113883.3.1259.10.1001</saml2:AttributeValue>
    </saml2:Attribute>
    <saml2:Attribute Name="urn:nhin:names:saml:homeCommunityId">
      <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance" xmlns:ns7="http://www.w3.org/2001/XMLSchema" ns6:type="ns7:string">urn:oid:2.16.840.1.113883.3.1259.10.1001</saml2:AttributeValue>
    </saml2:Attribute>
    <saml2:Attribute Name="urn:oasis:names:tc:xacml:2.0:subject:role">
      <saml2:AttributeValue>
        <hl7:Role xmlns:hl7="urn:hl7-org:v3" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" code="46255001" codeSystem="2.16.840.1.113883.6.96" codeSystemName="SNOMED_CT" displayName="Pharmacist" xsi:type="hl7:CE"/>
      </saml2:AttributeValue>
    </saml2:Attribute>
    <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:purposeofuse">
      <saml2:AttributeValue>
        <hl7:PurposeOfUse xmlns:hl7="urn:hl7-org:v3" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" code="TREATMENT" codeSystem="2.16.840.1.113883.3.18.7.1" codeSystemName="nhin-purpose" displayName="Treatment" xsi:type="hl7:CE"/>
      </saml2:AttributeValue>
    </saml2:Attribute>
    <saml2:Attribute Name="urn:oasis:names:tc:xacml:2.0:resource:resource-id">
      <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance" xmlns:ns7="http://www.w3.org/2001/XMLSchema" ns6:type="ns7:string">RI0002.000000010^^^&amp;2.16.840.1.113883.3.1259.10.1001&amp;ISO</saml2:AttributeValue>
    </saml2:Attribute>
  </saml2:AttributeStatement>
  <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:SignedInfo>
      <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
      <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
      <ds:Reference URI="#_0a559edda54f456a917fc9b4e69243a9">
        <ds:Transforms>
          <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
          <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
        </ds:Transforms>
        <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
        <ds:DigestValue>zYfPwHi3nhD9UiWU/PjUY8p2Qmg=</ds:DigestValue>
      </ds:Reference>
    </ds:SignedInfo>
    <ds:SignatureValue>HHAv7faYgZR6mwEGrHuArru8SuqJQNGa2/lFJyK1IBdQW7lsrRfPB351SYV75Kds/D/YSWRH4QAL
gu3rW7I9If8pc4Jf4ICIwMyGhzKQMy7N5h2pZGsrc2UIyyEt+0QWhjf37z7zc07RfbyfPfTiLUKG
rjhgmRO9FlQ8G2AOX8PfjMdlWyFKUcF56Qziv6mlVAvzEuJmKP6/oZQxe01GwWoA+7JddGyEEtZC
AhDnZR1dF13H3vrJtoZMHGZUVDeO7XrMhqlQA2Z5vCZ9GsSIZmAclSewh1BoImDvRUEVmFrnyZq5
bgSQkTAzzbfTILnMjMGF3WDxLBgA771nO3W6Ag==</ds:SignatureValue>
    <ds:KeyInfo>
      <ds:KeyValue>
        <ds:RSAKeyValue>
          <ds:Modulus>jT0q3UTlZ7maUp5VwmVbZvIv67gm3SFJjN+2EhJtg9TEdTFkL5aQAI06uU32kdqnLPyfWElZdmgG
tr6YHYfUy1K1o3wXK9jnX8JTL8oybNmDqkVw/TVXr9KD0vAw+8Iut1T7boDGdD7bnzwPBwImtyCI
m6S6Q4Wlx64xkq4gdhZTXkkSaKPyy517LgNCtzdigDVU+bZqAueWE1l4BOpHVrjULX8wLGjZloU4
rWqN0AvsjS1OpC0HO/aTxKznT4jD1PVNKJPLzlTU6e0RPuOMyTlccoPf2UeAMI+QZDim7uZ9IoE0
dMnqJLSGYq+KGfa0AZReg1OFXYzF2qicdmFKeQ==</ds:Modulus>
          <ds:Exponent>AQAB</ds:Exponent>
        </ds:RSAKeyValue>
      </ds:KeyValue>
    </ds:KeyInfo>
  </ds:Signature>
</saml2:Assertion>

Answer 1

斷言的XML中的節點順序是錯誤的，並且不符合SAML2。 瀏覽saml2-core，特別注意第5節。

Answer 2

感謝您的回答AndyK。我聯系了客戶，他們確認發送的SAML順序錯誤。