堆棧內存溢出
  簡體   English   中英

Spring SAML：更新元數據提供程序不會更新使用的簽名證書

[英]Spring SAML: updating Metadata Provider does not update signing certificates used

 原文  2018-10-17 20:31:03  9   1    java/ spring/ spring-saml

問題描述

我最近實施了一個 Spring SAML 解決方案，它允許客戶向服務注冊他們的 IdP 元數據並使用他們的 SAML 身份驗證來訪問我的 SP。

IDP中繼存儲為數據庫條目作為定制AbstractReloadingMetadataProvider實現的一部分，如建議在這里：

public class DbIdpMetadataProvider extends AbstractReloadingMetadataProvider {
...
  @Override
  protected byte[] fetchMetadata() throws MetadataProviderException {
  IdpProviderData provider  = null; // DAO of IdP metadata in DB

  try {

    log.info("Attempting to retrieve DB provider data for entity: " + entityId);

    provider = dbService.getIdpByEntityId(entityId);

    // verify that we have a provider
    if ( null != provider) {

      // get last update time recorded in DB
      DateTime lastUpdate = getLastUpdate();

      log.info("Performing refresh of Metadata Provider XML by reading from database");


      String metadataBody = provider.getMetadataBody();
      emitChangeEvent();
      return metadataBody.getBytes();
    }


    // if no provider, throw an exception as this metadata provider instance is invalid
    else {
      log.error("IdP Provider could not be found for EntityId: " + entityId );
      throw new MetadataProviderException("Metadata could not be found for String entity: " + entityId);
    }

  }
  catch(Exception e) {
    log.error("Failed to query database for provider entity: " + entityId);
    throw new MetadataProviderException("Failed to query database for provider entity: " + entityId, e);
  }

}

當元數據更新時，我將元數據 XML 保存到數據庫並從 CachingMetadataManager 中刪除元數據提供者的先前實例。 然后，我將元數據中的證書導入本地密鑰庫，並將新的元數據提供程序實例添加到 CachingMetadataManager：

@Autowired
private MetadataManager       metadataManager;

...

/**
 * Update our existing IdP metadata provider with new XML and other information
 */
public void updateIdpMetadata(IdPRegistrationData _data) throws RequiredDataException, NotFoundException, SystemException {
  IdpProviderData           provider;
  XMLObject                 xml;
  String                    metadataXml;
  EntityDescriptor          entity;
  String                    entityId;

  try {

    // validation
    validateIdpRegistrationData(_data);

    //ensure our top level DOM element is the IDPSSO entity descriptor, removing all other metadata
    xml         = parseMetadataXml(_data.getMetadataXml());
    entity      = getIDPSSOParentEntityDescriptor(xml);
    entityId    = entity.getEntityID();
    metadataXml = serialize(entity);

    // get our provider Data
    provider    = getIdpByAccountSysid(_data.getAccountSysid());

    if ( null == provider) {
      throw new NotFoundException(NotFoundExceptionType.ACCOUNT);
    }

    // update our provider
    provider.setEntityId(entityId);
    provider.setMetadataBody(metadataXml);

    // save data in database
    metadataStoreDao.saveAndFlush(provider);
    keystoreMgr.importMetadataCertificates(xml, provider.getUrlContext());

    // remove existing provider from metadata store
    removeDelegateFromManager(entityId);

    // reintroduce delegate to manager
    loadIdpMetadata(provider);

  }
  catch(NotFoundException e) {
    log.error("No previous version of IDP registration metadata found to update.",e);
    throw (e);
  }
  catch (MetadataProviderException e){
    log.error("Failed to update Keystore and Signing algorithm of IdP Metadata.",e);
    throw new SystemException("Failed to update certificates.");
  }
  catch(RequiredDataException e) {
    log.error("Missing required data for update.",e);
    throw(e);
  }

}

/**
 * Remove the metadata provider from our manager
 */
private void removeDelegateFromManager( String _entityId ) throws MetadataProviderException {
  ExtendedMetadataDelegate  delegate;
  DbIdpMetadataProvider     provider;

  delegate  = findMetadataDelegate(_entityId);

  if( null == delegate){
    log.error("Failed to find Delegate in metadata manager for Entity ID: " + _entityId );
    return;
  }

  metadataManager.removeMetadataProvider(delegate);
  provider = (DbIdpMetadataProvider)delegate.getDelegate();
  provider.destroy();
  metadataManager.setRefreshRequired(true);
  metadataManager.refreshMetadata();

}    

/**
 * load our provider data to a metadata provider object
 */
private void loadIdpMetadata(IdpProviderData _providerData) throws MetadataProviderException {
  DbIdpMetadataProvider idpProvider;

  // initialize our IdP provider
  idpProvider     = new DbIdpMetadataProvider(_providerData);
  idpProvider.setParserPool(parser);
  addIdpToMetadataManager(idpProvider);

}

/**
 * Add the metadata provider to our cache
 */
private void addIdpToMetadataManager(DbIdpMetadataProvider _provider) throws MetadataProviderException {
  ExtendedMetadataDelegate  delegate;
  ExtendedMetadata          extMeta = new ExtendedMetadata();

  // initialize our provider
  _provider.initialize();

  extMeta     = createExtendedMetadata(_provider);

  delegate    = new ExtendedMetadataDelegate(_provider, extMeta);
  delegate.setMetadataTrustCheck(false);
  delegate.initialize();

  metadataManager.addMetadataProvider(delegate);
  metadataManager.setRefreshRequired(true);
  metadataManager.refreshMetadata();
}

問題在於，當刷新數據庫條目時，不會應用在 IdP 元數據中的元素中定義的新簽名證書。

當我打印出元數據 XML 時，我可以看到新證書：

  <!--  new signing key  -->
  <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <KeyDescriptor use="encryption">
      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
        <X509Data>
          <X509Certificate>MIIC4jCCAcqgAwIBAgIQafZAY7...</X509Certificate>
        </X509Data>
      </KeyInfo>
    </KeyDescriptor>
    <KeyDescriptor use="signing">
      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
        <X509Data>
          <X509Certificate>MIIC3DCCAcSgAwIBAgIQeny6jM...</X509Certificate>
        </X509Data>
      </KeyInfo>
    </KeyDescriptor>
    <KeyDescriptor use="signing">
      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
        <X509Data>
          <X509Certificate>MIIC3DCCAcSgAwIBAgIQRtno3W...</X509Certificate>
        </X509Data>
      </KeyInfo>

在 SP 啟動登錄時，我收到了來自 IdP 的 SUCCESS SAML 響應：

<?xml version="1.0" encoding="UTF-8"?>
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified" Destination="https://{my-domain}:443/eas-saml/saml/SSO" ID="_0d023fb8-bf24-4b78-b690-c9b53df4db72" InResponseTo="a22h6bb0gf2e8f314e00316b198ddg1" IssueInstant="2018-10-17T18:31:47.332Z" Version="2.0">
   <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">http://{my-domain}/adfs/services/trust</Issuer>
   <samlp:Status>
      <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
   </samlp:Status>
   <Assertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion" ID="_317d062d-247e-4405-9dd8-0ef3d032bf3f" IssueInstant="2018-10-17T18:31:47.332Z" Version="2.0">
      <Issuer>http://{my-domain}/adfs/services/trust</Issuer>
      <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
         <ds:SignedInfo>
            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
            <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
            <ds:Reference URI="#_8049000b-6e76-416c-84aa-180d61ca359a">
               <ds:Transforms>
                  <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                  <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
               </ds:Transforms>
               <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
               <ds:DigestValue>x/PKyqXDECmE2IBNiZ0pqet3HqQYgDwlbeo1Vb3gXD8=</ds:DigestValue>
            </ds:Reference>
         </ds:SignedInfo>
         <ds:SignatureValue>UvhpsDE7XT1uvqGbA+IZ2sC9t8x0i42/P7tdNXO...</ds:SignatureValue>
         <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
            <ds:X509Data>
               <ds:X509Certificate>MIIC3DCCAcSgAwIBAgIQRtno3W...</ds:X509Certificate>
            </ds:X509Data>
         </KeyInfo>
      </ds:Signature>
      <Subject>
         <NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">userId</NameID>
         <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
            <SubjectConfirmationData InResponseTo="a22h6bb0gf2e8f314e00316b198ddg1" NotOnOrAfter="2018-10-17T18:36:47.332Z" Recipient="https://{my-domain}:443/eas-saml/saml/SSO"/>
         </SubjectConfirmation>
      </Subject>
      <Conditions NotBefore="2018-10-17T18:31:47.327Z" NotOnOrAfter="2018-10-17T18:33:47.327Z">
         <AudienceRestriction>
            <Audience>https://{my-domain}/eas-saml</Audience>
         </AudienceRestriction>
      </Conditions>
      <AttributeStatement>
         <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn">
            <AttributeValue>userId</AttributeValue>
         </Attribute>
         <Attribute Name="http://E-Mail-Addresses">
            <AttributeValue>user@domain.com</AttributeValue>
         </Attribute>
      </AttributeStatement>
      <AuthnStatement AuthnInstant="2018-10-17T18:31:47.233Z" SessionIndex="_317d062d-247e-4405-9dd8-0ef3d032bf3f">
         <AuthnContext>
            <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</AuthnContextClassRef>
         </AuthnContext>
      </AuthnStatement>
   </Assertion>
</samlp:Response>

日志輸出顯示以下堆棧跟蹤失敗：

2018-10-17 18:31:47 INFO  SAMLDefaultLogger:129 - AuthNResponse;FAILURE;172.17.0.1;https://{my-domain}/eas-saml;http://{my-domain}/adfs/services/trust;;;org.opensaml.common.SAMLException: Response doesn't have any valid assertion which would pass subject validation
      at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.processAuthenticationResponse(WebSSOProfileConsumerImpl.java:229)
      at org.springframework.security.saml.SAMLAuthenticationProvider.authenticate(SAMLAuthenticationProvider.java:88)
      at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:174)
      at org.springframework.security.saml.SAMLProcessingFilter.attemptAuthentication(SAMLProcessingFilter.java:92)
      at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
      at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215)
      at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:186)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
      at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64)
      at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
      at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
      at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
      at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
      at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215)
      at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)
    Caused by: org.opensaml.xml.validation.ValidationException: Signature is not trusted or invalid
      at org.springframework.security.saml.websso.AbstractProfileBase.verifySignature(AbstractProfileBase.java:272)
      at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.verifyAssertionSignature(WebSSOProfileConsumerImpl.java:419)
      at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.verifyAssertion(WebSSOProfileConsumerImpl.java:292)
      at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.processAuthenticationResponse(WebSSOProfileConsumerImpl.java:214)
      ... 39 more

如果我重新啟動服務，則會識別簽名並成功處理響應。

誰能看到我可能做錯了什么？ 元數據管理器的刷新是否足以允許使用新證書？ 還是我遺漏了一步？

1 個解決方案

解決方案1
 3  2018-10-18 18:05:56

我在另一個帖子里找到了答案

由於我目前使用的是 XML 配置文件，因此我修改了安全上下文 XML 以設置 Credential Resolver，如下所示：

<!-- Provider of default SAML Context -->
<bean id="contextProvider" class="org.springframework.security.saml.context.SAMLContextProviderImpl">
  <property name="metadataResolver">
            <bean class="com.mydomain.CustomMetadataCredentialResolver">
                <constructor-arg index="0" ref="metadata" />
                <constructor-arg index="1" ref="keyManager" />
                <property name="useXmlMetadata" value="true" />
            </bean>
  </property> 
</bean>

然后我創建了一個擴展org.springframework.security.saml.trust.MetadataCredentialResolver的類

現在，我只是覆蓋了 cacheCredentials 方法：

@Component
public class CustomMetadataCredentialResolver extends MetadataCredentialResolver {

  public CustomMetadataCredentialResolver(MetadataManager metadataProvider, KeyManager keyManager) {
    super(metadataProvider, keyManager);
  }

  @Override
  protected void cacheCredentials( MetadataCacheKey cacheKey, Collection<Credential> credentials ) {
    //no-op
  }
}

我可能會清理它以根據命令清除緩存，而不是從不緩存憑據，但現在它可以工作。

暫無
暫無

聲明:本站的技術帖子網頁，遵循CC BY-SA 4.0協議，如果您需要轉載，請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.

相關問題 SAML - 解析服務提供者元數據並提取詳細信息，例如簽名證書和斷言消費者端點 Spring SAML SSO-IDP元數據不包含SingleSignOnService SAML服務提供商的彈簧安全性 用於簽署證書的SAML樣本身份提供者證書和Java應用程序 Spring Security 5.2+ Saml 元數據 如何在Spring Security SAML示例中配置IDP元數據和SP元數據？ Spring Security與遠程身份驗證提供程序（SAML）集成 Spring Security SAML與ADFS集成-metadata.xml Spring SAML 2.0-導入IDP的本地元數據-MetadataProviderException 如何在新的 Spring SAML2 中指定 CryptoComply 算法提供程序？
相關標簽
 
粵ICP備18138465號  © 2020-2024 STACKOOM.COM