java 如何在 Spring Security SAML 示例中配置 IDP 元数据和 SP 元数据？

How to configuration of IDP metadata and SP metadata in Spring Security SAML sample?

提问by somebody

I want to deal with Spring Security SAML. For this, I start to explore Spring Security SAML. At the beginning, I create an account at SSOCircle. Than I configurated of IDP metadata and generation of SP metadata (4.2.2 and 4.2.3). At entityIdI set:

我想处理 Spring Security SAML。为此，我开始探索Spring Security SAML。一开始，我在SSOCircle创建了一个帐户。比我配置的 IDP 元数据和生成 SP 元数据（4.2.2 和 4.2.3）。在entityId我设置：

 <bean id="metadataGeneratorFilter" class="org.springframework.security.saml.metadata.MetadataGeneratorFilter">
    <constructor-arg>
        <bean class="org.springframework.security.saml.metadata.MetadataGenerator">
            <property name="entityId" value="http://idp.ssocircle.com"/>
        </bean>
    </constructor-arg>
 </bean>

When I start application, I have:

当我开始申请时，我有：

Error occurred:
Reason: Unable to do Single Sign On or Federation.

or

或者

Error occurred:
Reason: Unable to get AuthnRequest.

How to configure Spring Security SAML?

如何配置 Spring Security SAML？

回答by RonanOD

Follow the steps in the QuickStartchapter. Some differences to note:

按照快速入门章节中的步骤进行操作。需要注意的一些差异：

1. Sign up at http://www.ssocircle.com/. You need to verify your email address.

2. The metadataGeneratorFilter section of sample/src/main/webapp/WEB-INF/securityContext.xml should look like this (Note:signMetadata property is commented out):

   <bean id="metadataGeneratorFilter" class="org.springframework.security.saml.metadata.MetadataGeneratorFilter">
   <constructor-arg>
       <bean class="org.springframework.security.saml.metadata.MetadataGenerator">
         <property name="entityId" value="urn:test:YourName:YourCity"/>
     <!--<property name="signMetadata" value="false"/>-->
       </bean>
   </constructor-arg>
   

3. Build and start the web server locally. Then download the metadata at http://localhost:8080/spring-security-saml2-sample/saml/metadata. Copy the contents to your clipboard.
4. Update the metadata of your new profile at https://idp.ssocircle.com/sso/hos/ManageSPMetadata.jsp.
5. Enter the FQDN of the service as "urn:test:YourName:YourCity". You need to enter unique values for Your Name and Your City. Paste in the metadata from above.
6. To Test:
   1. Logout of SSO Circle Service.
   2. Go to http://localhost:8080/spring-security-saml2-sample
   3. You should be redirected to the SSO Circle login.
   4. Login with your SSO Circle credentials.
   5. You should be redirected to your local service provider page and authenticated.

1. 在http://www.ssocircle.com/注册。您需要验证您的电子邮件地址。

2. sample/src/main/webapp/WEB-INF/securityContext.xml 的 metadataGeneratorFilter 部分应如下所示（注意：signMetadata 属性已注释掉）：

   <bean id="metadataGeneratorFilter" class="org.springframework.security.saml.metadata.MetadataGeneratorFilter">
   <constructor-arg>
       <bean class="org.springframework.security.saml.metadata.MetadataGenerator">
         <property name="entityId" value="urn:test:YourName:YourCity"/>
     <!--<property name="signMetadata" value="false"/>-->
       </bean>
   </constructor-arg>
   

3. 在本地构建并启动 Web 服务器。然后在http://localhost:8080/spring-security-saml2-sample/saml/metadata 下载元数据。将内容复制到剪贴板。
4. 在https://idp.ssocircle.com/sso/hos/ManageSPMetadata.jsp更新您的新配置文件的元数据。
5. 输入服务的 FQDN 作为“urn:test:YourName:YourCity”。您需要为您的姓名和您的城市输入唯一值。从上面粘贴元数据。
6. 去测试：
   1. 注销 SSO Circle 服务。
   2. 转到http://localhost:8080/spring-security-saml2-sample
   3. 您应该被重定向到 SSO Circle 登录。
   4. 使用您的 SSO Circle 凭据登录。
   5. 您应该被重定向到您的本地服务提供商页面并进行身份验证。

回答by Vladimír Sch?fer

The metadata generator filter generates metadata for your application (service provider). The entity id you're providing (http://idp.ssocircle.com) is already used by the SSO Circle, you should create a unique value which describes your application, e.g. urn:test:helsinki:myapp

元数据生成器过滤器为您的应用程序（服务提供者）生成元数据。您提供的实体 ID ( http://idp.ssocircle.com) 已被 SSO Circle 使用，您应该创建一个描述您的应用程序的唯一值，例如 urn:test:helsinki:myapp

Just like the manual says:

就像说明书上说的：

make sure to replace the entityId value with a string which is unique within the SSO Circle service (e.g. urn:test:yourname:yourcity)

确保将 entityId 值替换为 SSO Circle 服务中唯一的字符串（例如 urn:test:yourname:yourcity）