Keycloak 和 Spring SAML：SigAlg 为空

Posted 2023-02-27

【中文标题】Keycloak 和 Spring SAML：SigAlg 为空

【英文标题】：Keycloak and Spring SAML: SigAlg was null

【发布时间】：2018-11-10 04:30:40

【问题描述】：

我正在尝试使用 Spring Security、Spring Security SAML 和 Keycloak 设置 POC。为此，我使用了 Spring SAML 核心项目提供的 simple-service-provider 示例。

只要 Keycloak 不需要客户端签名（禁用客户端签名），我就设法让 SAML 设置正常工作。当我启用此选项时，我在 Keycloak 中收到以下错误和堆栈跟踪

07:07:40,385 WARN  [org.keycloak.events] (default task-8) type=LOGIN_ERROR, realmId=ea-localhost, clientId=null, userId=null, ipAddress=172.17.0.1, error=invalid_signature
07:07:44,961 ERROR [org.keycloak.protocol.saml.SamlService] (default task-7) request validation failed: org.keycloak.common.VerificationException: SigAlg was null
        at org.keycloak.protocol.saml.SamlProtocolUtils.verifyRedirectSignature(SamlProtocolUtils.java:135)
        at org.keycloak.protocol.saml.SamlService$RedirectBindingProtocol.verifySignature(SamlService.java:518)
        at org.keycloak.protocol.saml.SamlService$BindingProtocol.handleSamlRequest(SamlService.java:233)
        at org.keycloak.protocol.saml.SamlService$BindingProtocol.execute(SamlService.java:478)
        at org.keycloak.protocol.saml.SamlService.redirectBinding(SamlService.java:553)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

Spring配置如下

spring:
  thymeleaf:
    cache: false
  security:
    saml2:
      service-provider:
        entity-id: spring-saml-test
        sign-metadata: false
        sign-requests: true
        want-assertions-signed: true
        keys:
          active:
            - name: key
              type: SIGNING
              private-key: |
                -----BEGIN RSA PRIVATE KEY-----
                SNIP
                -----END RSA PRIVATE KEY-----

              passphrase: SNIP
              certificate: |  
                -----BEGIN CERTIFICATE-----
                SNIP
                -----END CERTIFICATE-----
            - name: key
              type: ENCRYPTION
              private-key: |
                -----BEGIN RSA PRIVATE KEY-----
                SNIP
                -----END RSA PRIVATE KEY-----

              passphrase: SNIP
              certificate: |  
                -----BEGIN CERTIFICATE-----
                SNIP
                -----END CERTIFICATE-----

        providers:
        - name: keycloak
          metadata: |
                    <?xml version="1.0" encoding="UTF-8"?>
                    <EntityDescriptor entityID="http://localhost:8090/auth/realms/ea-localhost"
                                       xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
                                       xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"
                                       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
                       <IDPSSODescriptor WantAuthnRequestsSigned="true"
                          protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
                          <SingleLogoutService
                             Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                             Location="http://localhost:8090/auth/realms/ea-localhost/protocol/saml" />
                       <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
                       <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
                       <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
                       <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>

                          <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                             Location="http://localhost:8090/auth/realms/ea-localhost/protocol/saml" />
                          <KeyDescriptor use="signing">
                            <dsig:KeyInfo>
                              <dsig:KeyName>tURdSWRSOIQXpkOdAZzAevrtov8QU5ea0dqJpng2hSY</dsig:KeyName>
                              <dsig:X509Data>
                                <dsig:X509Certificate>SNIP</dsig:X509Certificate>
                              </dsig:X509Data>
                            </dsig:KeyInfo>
                          </KeyDescriptor>
                       </IDPSSODescriptor>
                    </EntityDescriptor>



          link-text: KEYCLOAK LOCAL IDP
          name-id: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

这是一个发送到 keycloak 的示例请求

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest AssertionConsumerServiceIndex="0" AssertionConsumerServiceURL="http://localhost:8080/sample-sp/saml/sp/SSO" Destination="http://localhost:8090/auth/realms/ea-localhost/protocol/saml" ForceAuthn="false" ID="1a072bcf-2822-424d-98ea-5e1f0c3b83b7" IsPassive="false" IssueInstant="2018-05-31T08:00:42.939Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">spring-saml-test</saml2:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo>
            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
            <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
            <ds:Reference URI="#1a072bcf-2822-424d-98ea-5e1f0c3b83b7">
                <ds:Transforms>
                    <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                </ds:Transforms>
                <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                <ds:DigestValue>R/D3Qk8KmcZdTwBZypDDq+D8lcMpvYcElmiwg01dYK0=</ds:DigestValue>
            </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>
gldzIzX2Ti+nHhz99jQgLwLQ1IZnNJBGM39MpBo7pcFmWQ83Y4R4Bv+OfGbdmqO8GTbZo86zjRM0
+c1w+/QFvbZv4hEudIFuuDbzgCcTG2tyFau525+T7IZcBuPXexYEE+JX/y9cZifo7ws7EolfUC/V
e3qHlYGzOx/cPx6qPem6QawDaU8X46WkYDIOjAJGxrbqGY8fR3YC+PGndD4/+47Zrcp58REBUDPH
X680RZJP+06nnOIS5seKuIOyzEYmz8FLrsN2RLy0QnR3Qws+aWoP0ut04CFgmpcV5JmmNpMXASIT
86Xy53N6q1XvXqAhZuwG1WUriJBZD0mCPDmDhA==
        </ds:SignatureValue>
        <ds:KeyInfo>
            <ds:X509Data>
                <ds:X509Certificate>SNIP</ds:X509Certificate>
            </ds:X509Data>
        </ds:KeyInfo>
    </ds:Signature>
    <saml2p:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
    <saml2p:RequestedAuthnContext Comparison="exact"/>
</saml2p:AuthnRequest>

我尝试了不同的组合，但只要 Keycloak 验证签名，就会引发异常。 Keycloak中导致异常的代码是这样的：

public static void verifyRedirectSignature(SAMLDocumentHolder documentHolder, KeyLocator locator, UriInfo uriInformation, String paramKey) throws VerificationException 
    MultivaluedMap<String, String> encodedParams = uriInformation.getQueryParameters(false);
    String request = encodedParams.getFirst(paramKey);
    String algorithm = encodedParams.getFirst(GeneralConstants.SAML_SIG_ALG_REQUEST_KEY);
    String signature = encodedParams.getFirst(GeneralConstants.SAML_SIGNATURE_REQUEST_KEY);
    String relayState = encodedParams.getFirst(GeneralConstants.RELAY_STATE);
    String decodedAlgorithm = uriInformation.getQueryParameters(true).getFirst(GeneralConstants.SAML_SIG_ALG_REQUEST_KEY);

    if (request == null) throw new VerificationException("SAM was null");
    if (algorithm == null) throw new VerificationException("SigAlg was null");
    if (signature == null) throw new VerificationException("Signature was null");

我在这里做错了什么？还是 Spring Saml 的 Keycloak 中的错误？ 我正在使用 Keycloak 4.0.0.Beta2，但在最新的 v3 中也出现了同样的问题。 我从 github 中提取了最新的 spring-security-saml 代码（2.0.0.BUILD-SNAPSHOT，48ccd77ebabb5465af81a53b7095cdfb466a62b5）。

【问题讨论】：

我在这里遇到了类似的错误，但这是我的错，我将“需要客户端签名”与“签名断言”配置标志混合在一起。

【参考方案1】：

AuthNRequest 以 REDIRECT 形式发送，但格式化为 POST。 这是一个错误。

https://github.com/spring-projects/spring-security/issues/7711

解决方法是关闭传入 AuthNRequest 的签名要求，以确保 IDP 使用白名单/配置的 URL，而不是 AuthNRequest 消息本身中的 URL。