使用 Spring SAML 从 https 加载元数据
-
21-12-2019 - |
题
我想通过使用从网络导入一些元数据 https 协议:
@Bean
public HTTPMetadataProvider ssoCircleMetadataProvider()
throws MetadataProviderException {
String metadataURL = "https://idp.ssocircle.com/idp-meta.xml";
final Timer backgroundTaskTimer = new Timer(true);
HTTPMetadataProvider provider = new HTTPMetadataProvider(
backgroundTaskTimer, httpClient(), metadataURL);
provider.setParserPool(parserPool());
return provider;
}
通过阅读 文档, ,我找到了这一步:
默认情况下,使用HTTPS的基于HTTP的提供商对元数据的加载执行JDK中配置的信任验证。如果您想在密钥库中使用证书,请添加以下bean,以更改HTTP客户端使用的套接字:
<bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
<property name="targetClass" value="org.apache.commons.httpclient.protocol.Protocol"/>
<property name="targetMethod" value="registerProtocol"/>
<property name="arguments">
<list>
<value>https</value>
<bean class="org.apache.commons.httpclient.protocol.Protocol">
<constructor-arg value="https"/>
<constructor-arg>
<bean class="org.springframework.security.saml.trust.httpclient.TLSProtocolSocketFactory"/>
</constructor-arg>
<constructor-arg value="443"/>
</bean>
</list>
</property>
</bean>
在Java Config中转换成:
@Bean
public Protocol httpClientProtocol() {
org.springframework.security.saml.trust.httpclient.TLSProtocolSocketFactory factory =
new org.springframework.security.saml.trust.httpclient.TLSProtocolSocketFactory();
Protocol httpClientProtocol = new Protocol ("https", factory, 443);
return httpClientProtocol;
}
@Bean
public MethodInvokingFactoryBean methodInvokingFactoryBean() {
MethodInvokingFactoryBean methodInvokingFactoryBean = new MethodInvokingFactoryBean();
methodInvokingFactoryBean.setTargetClass(Protocol.class);
methodInvokingFactoryBean.setTargetMethod("registerProtocol");
Object[] args = {"https", httpClientProtocol()};
methodInvokingFactoryBean.setArguments(args);
return methodInvokingFactoryBean;
}
但是 org.springframework.security.saml.trust.httpclient.TLSProtocolSocketFactory
未找到班级成绩。我正在使用的版本 1.0.0-RC2
的 春季 SAML.
难道我做错了什么?
如何修复此错误并根据需要加载元数据?
更新
通过使用 SNAPSHOT 存储库,我可以使用 TLSProtocolSocketFactory 类。我已将 SSOCircle 的证书导入到我的密钥库中,但尽管如此,应用程序仍返回错误,如下所示:
[2014-07-31 17:33:27.596] boot - 11800 ERROR [localhost-startStop-1] --- HTTPMetadataProvider: Error retrieving metadata from https://idp.ssocircle.com/idp-meta.xml
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
更新2
我已经根据您的建议修复了我的代码。我已将所有证书导入密钥库,但在启动时应用程序返回此错误:
[2014-08-01 10:02:38.961] boot - 14704 DEBUG [localhost-startStop-1] --- BasicX509CredentialNameEvaluator: Supplied trusted names are null or empty, skipping name evaluation
[2014-08-01 10:02:38.962] boot - 14704 DEBUG [localhost-startStop-1] --- MetadataCredentialResolver: Attempting PKIX path validation on untrusted credential: [subjectName='CN=ADFS Signing - ststest-vdenotarisnet.vdenotaris.it']
[2014-08-01 10:02:39.028] boot - 14704 ERROR [localhost-startStop-1] --- MetadataCredentialResolver: PKIX path construction failed for untrusted credential: [subjectName='CN=ADFS Signing - ststest-vdenotarisnet.vdenotaris.it']: unable to find valid certification path to requested target
[2014-08-01 10:02:39.028] boot - 14704 DEBUG [localhost-startStop-1] --- PKIXSignatureTrustEngine: Signature trust could not be established via PKIX validation of signing credential
[2014-08-01 10:02:39.028] boot - 14704 DEBUG [localhost-startStop-1] --- BaseSignatureTrustEngine: Failed to establish trust of KeyInfo-derived credential
[2014-08-01 10:02:39.028] boot - 14704 DEBUG [localhost-startStop-1] --- BaseSignatureTrustEngine: Failed to verify signature and/or establish trust using any KeyInfo-derived credentials
[2014-08-01 10:02:39.029] boot - 14704 DEBUG [localhost-startStop-1] --- PKIXSignatureTrustEngine: PKIX validation of signature failed, unable to resolve valid and trusted signing key
[2014-08-01 10:02:39.029] boot - 14704 ERROR [localhost-startStop-1] --- SignatureValidationFilter: Signature trust establishment failed for metadata entry http://ststest.vdenotaris.local/adfs/services/trust
[2014-08-01 10:02:39.031] boot - 14704 ERROR [localhost-startStop-1] --- AbstractReloadingMetadataProvider: Error filtering metadata from https://ststest.vdenotaris.local/FederationMetadata/2007-06/FederationMetadata.xml
org.opensaml.saml2.metadata.provider.FilterException: Signature trust establishment failed for metadata entry
请注意,所使用的证书是由 GoDaddy 验证的。
解决方案
这 TLSProtocolSocketFactory
类仅在主干中可用,并且将成为 1.0.0.FINAL 的一部分。RC2 中唯一的选择是将密钥添加到 JDK 的密钥库。
更新:
此存储库中提供了 Spring SAML 的快照版本:
<repository>
<releases>
<enabled>false</enabled>
</releases>
<snapshots>
<enabled>true</enabled>
</snapshots>
<id>com.springsource.repository.maven.snapshot</id>
<name>SpringSource Enterprise Bundle Maven Repository - SpringSource Snapshot Releases</name>
<url>http://maven.springframework.org/snapshot</url>
</repository>
您可能需要阅读“新增内容”一章,其中列出了自 RC2 以来的更改,其中一些更改涉及向后兼容性。
另一个更新:
您的初始化是错误的,TLSFactory 需要作为 bean 启动,您可能还需要 MetadataManager 中的依赖项。
@Bean
public ProtocolSocketFactory socketFactory() {
return new TLSProtocolSocketFactory();
}
@Bean
public Protocol socketFactoryProtocol() {
return new Protocol("https", socketFactory(), 443);
}
@Bean
public MethodInvokingFactoryBean socketFactoryInitialization() {
MethodInvokingFactoryBean methodInvokingFactoryBean = new MethodInvokingFactoryBean();
methodInvokingFactoryBean.setTargetClass(Protocol.class);
methodInvokingFactoryBean.setTargetMethod("registerProtocol");
Object[] args = {"https", socketFactoryProtocol()};
methodInvokingFactoryBean.setArguments(args);
return methodInvokingFactoryBean;
}
@Bean
@Qualifier("metadata")
@DependsOn("socketFactoryInitialization")
public CachingMetadataManager metadata() throws MetadataProviderException, IOException {
...
}
不隶属于 StackOverflow