java SAML 元数据条目的签名信任建立失败

Question

提问by vdenotaris

In order to fetch metadata from a remote source, I defined an ExtendedMetadataDelegatebean as follows:

为了从远程源获取元数据，我定义了一个ExtendedMetadataDelegatebean，如下所示：

@Bean
@Qualifier("replyMeta")
public ExtendedMetadataDelegate replyMetadataProvider() throws MetadataProviderException {
    String metadataURL = "https://ststest.mydomain.it/FederationMetadata/2007-06/FederationMetadata.xml";
    final Timer backgroundTaskTimer = new Timer(true);
    HTTPMetadataProvider provider = new HTTPMetadataProvider(
            backgroundTaskTimer, httpClient(), metadataURL);
    provider.setParserPool(parserPool());
    ExtendedMetadataDelegate emd = new ExtendedMetadataDelegate(
            provider, new ExtendedMetadata());
    return emd;
}

To ensure the signature trust establishment, I added the related key both in JDK keystore and application keystore (the second step might not be enough); despite that, an error occurs by running the webapp.

为了保证签名信任的建立，我在JDK keystore和application keystore中都添加了相关的key（第二步可能不够）；尽管如此，运行 webapp 还是会发生错误。

[2014-08-18 14:36:47.200] boot - 6000 DEBUG [localhost-startStop-1] --- SignatureValidator: Attempting to validate signature using key from supplied credential
[2014-08-18 14:36:47.200] boot - 6000 DEBUG [localhost-startStop-1] --- SignatureValidator: Creating XMLSignature object
[2014-08-18 14:36:47.206] boot - 6000 DEBUG [localhost-startStop-1] --- SignatureValidator: Validating signature with signature algorithm URI: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
[2014-08-18 14:36:47.207] boot - 6000 DEBUG [localhost-startStop-1] --- SignatureValidator: Validation credential key algorithm 'RSA', key instance class 'sun.security.rsa.RSAPublicKeyImpl'
[2014-08-18 14:36:47.329] boot - 6000 DEBUG [localhost-startStop-1] --- SignatureValidator: Signature validated with key from supplied credential
[2014-08-18 14:36:47.329] boot - 6000 DEBUG [localhost-startStop-1] --- BaseSignatureTrustEngine: Signature validation using candidate credential was successful
[2014-08-18 14:36:47.330] boot - 6000 DEBUG [localhost-startStop-1] --- BaseSignatureTrustEngine: Successfully verified signature using KeyInfo-derived credential
[2014-08-18 14:36:47.330] boot - 6000 DEBUG [localhost-startStop-1] --- BaseSignatureTrustEngine: Attempting to establish trust of KeyInfo-derived credential
[2014-08-18 14:36:47.330] boot - 6000 DEBUG [localhost-startStop-1] --- BasicX509CredentialNameEvaluator: Supplied trusted names are null or empty, skipping name evaluation
[2014-08-18 14:36:47.331] boot - 6000 DEBUG [localhost-startStop-1] --- MetadataCredentialResolver: Attempting PKIX path validation on untrusted credential: [subjectName='CN=ADFS Signing - ststest-replynet.reply.it']
[2014-08-18 14:36:47.346] boot - 6000 ERROR [localhost-startStop-1] --- MetadataCredentialResolver: PKIX path construction failed for untrusted credential: [subjectName='CN=ADFS Signing - ststest-replynet.reply.it']: unable to find valid certification path to requested target
[2014-08-18 14:36:47.347] boot - 6000 DEBUG [localhost-startStop-1] --- PKIXSignatureTrustEngine: Signature trust could not be established via PKIX validation of signing credential
[2014-08-18 14:36:47.347] boot - 6000 DEBUG [localhost-startStop-1] --- BaseSignatureTrustEngine: Failed to establish trust of KeyInfo-derived credential
[2014-08-18 14:36:47.347] boot - 6000 DEBUG [localhost-startStop-1] --- BaseSignatureTrustEngine: Failed to verify signature and/or establish trust using any KeyInfo-derived credentials
[2014-08-18 14:36:47.347] boot - 6000 DEBUG [localhost-startStop-1] --- PKIXSignatureTrustEngine: PKIX validation of signature failed, unable to resolve valid and trusted signing key
[2014-08-18 14:36:47.347] boot - 6000 ERROR [localhost-startStop-1] --- SignatureValidationFilter: Signature trust establishment failed for metadata entry http://ststest-replynet.reply.it/adfs/services/trust
[2014-08-18 14:36:47.349] boot - 6000 ERROR [localhost-startStop-1] --- AbstractReloadingMetadataProvider: Error filtering metadata from https://ststest-replynet.reply.it/FederationMetadata/2007-06/FederationMetadata.xml
org.opensaml.saml2.metadata.provider.FilterException: Signature trust establishment failed for metadata entry

The error disappears by setting:

通过设置错误消失：

emd.setMetadataTrustCheck(false);

... but I'd like to check used metadata.

...但我想检查使用的元数据。

Is there a way to resolve this error?

有没有办法解决这个错误？

Update:

更新：

I tried to setup the ExtendedMetadataas follows but the error persists.

我尝试设置ExtendedMetadata如下，但错误仍然存在。

em.setAlias("defaultAlias");
em.setSigningKey("*.mydomain.it (Go Daddy Secure Certification Authority)");

Answer 1

回答by Vladimír Sch?fer

You have most likely imported the HTTPS certificate, but not the certificate which is used to create the signature - they differ. You should:

您很可能导入了 HTTPS 证书，但没有导入用于创建签名的证书 - 它们不同。你应该：

Create file signature.cer with the following content taken from the metadata:

Import the certificate to your samlKeystore.jks with:

 keytool -importcert -alias adfssigning -keystore samlKeystore.jks -file signature.cer

使用从元数据中获取的以下内容创建文件 signature.cer：

使用以下命令将证书导入 samlKeystore.jks：

 keytool -importcert -alias adfssigning -keystore samlKeystore.jks -file signature.cer

This should be all you need, just restart Tomcat and your metadata loading should now pass.

这应该就是您所需要的，只需重新启动 Tomcat，您的元数据加载现在就应该通过了。

You don't need to include the HTTPS certificate in your JDK's cacerts in case you include the following bean which configures the HTTP client (available in Spring SAML 1.0.0.RELEASE):

如果您包含以下配置 HTTP 客户端的 bean（在 Spring SAML 1.0.0.RELEASE 中可用），则不需要在 JDK 的 cacerts 中包含 HTTPS 证书：

 <bean class="org.springframework.security.saml.trust.httpclient.TLSProtocolConfigurer"/>

Answer 2

回答by Manoj

I'm posting this just in case if it may be helpful even after everything you did like accepted answer for this question and still get the same error.

我发布这个只是为了以防万一它可能会有所帮助，即使在你所做的一切都喜欢接受这个问题的答案后仍然得到同样的错误。

I too had this problem, I have added IDP's metadata file and imported their certificate into my app keystore. But still had Signature trust verification problem. I did format the metadata.xml from IDP in Intellij, that did some screw up. Once I imported their metadata file as it without formatting, everything went ok.

我也有这个问题，我添加了 IDP 的元数据文件并将他们的证书导入到我的应用程序密钥库中。但是仍然存在签名信任验证问题。我确实在 Intellij 中从 IDP 格式化了 metadata.xml，这确实搞砸了。一旦我在没有格式化的情况下导入了他们的元数据文件，一切就正常了。

java SAML 元数据条目的签名信任建立失败

提问by vdenotaris

Update:

更新：

回答by Vladimír Sch?fer

回答by Manoj

相关推荐

最近更新

标签

java SAML 元数据条目的签名信任建立失败

提问by vdenotaris

Update:

更新：

回答by Vladimír Sch?fer

回答by Manoj

相关推荐

java CoberturaInstrumenter - 无法检测文件？

java 无法通过反射设置器设置字段值

java Spring Framework 自动装配空指针异常

java 可以使用函数式操作

相关推荐

最近更新

标签