没有签名的AuthnRequest在Gitlab上使用SAML

Question

我尝试使用SAML 2.0在Gitlab上实现SSO，我遇到了一些问题。

我公司的IdP经理给我发了他们的元数据，并按照关于SAML的Gitlab文档我配置了这样的Gitlab。

gitlab_rails['omniauth_enabled'] = true
gitlab_rails['omniauth_allow_single_sign_on'] = ['saml']
gitlab_rails['omniauth_block_auto_created_users'] = true
gitlab_rails['omniauth_auto_link_ldap_user'] = false
gitlab_rails['omniauth_auto_link_saml_user'] = false

gitlab_rails['omniauth_providers'] =
[
   {
name: "saml",
args:
{
assertion_consumer_service_url: "https://my.domain.com/gitlab/auth/saml/callback",
idp_cert: "
-----BEGIN CERTIFICATE-----
IDP_Certificate
-----END CERTIFICATE-----
",
idp_sso_target_url: "https://my_idp_target_URL",
issuer: "sp-gitlab",
name_identifier_format: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",

},
label: "SSO"
}
 ]

我将我的元数据发送给了IdP，他们被接受了。

<?xml version="1.0"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2017-11-22T09:24:33Z" ID="_1910909d-5325-4cba-a56f-4f9082e05e24" entityID="sp-gitlab">
    <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <md:KeyDescriptor use="signing">
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
          <ds:X509Certificate>
            My cert
</ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>
    <md:KeyDescriptor use="encryption">
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
          <ds:X509Certificate>
            Mycert
    </ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>
        <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
        <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://my.domain.com/gitlab/auth/saml/callback" index="0" isDefault="true"/>
        <md:AttributeConsumingService index="1" isDefault="true">
            <md:ServiceName xml:lang="en">Required attributes</md:ServiceName>
            <md:RequestedAttribute FriendlyName="Email address" Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
            <md:RequestedAttribute FriendlyName="Full name" Name="name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
            <md:RequestedAttribute FriendlyName="Given name" Name="first_name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
            <md:RequestedAttribute FriendlyName="Family name" Name="last_name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
        </md:AttributeConsumingService>
    </md:SPSSODescriptor>
</md:EntityDescriptor>

当我尝试使用SSO连接到Gitlab时出现错误。我的AuthnRequest的签名不存在。 IdP的经理告诉我问题来自我的申请证书。所以这是关于Gitlab HTTPS的问题

nginx['redirect_http_to_https'] = true
nginx['redirect_http_to_https_port'] = 443
...
nginx['ssl_certificate'] = "/etc/gitlab/ssl/prod.cer"
nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/prod.key"

我的Gitlab实例运行在Apache Proxy之后，用于Gitlab的证书也用于这个Apache的网站。

那么为什么我的AuthnRequest中没有签名？我错在哪里或者我错过了什么？

附：：我是SAML和Gitlab配置的新手，所以我可能错过了一些明显的东西

Answer 1

另一答案