如何验证 SAML 签名值
我有一位客户正在发送安全密钥。他们使用的加密是三重 DES。他们发送的每个断言都有一个签名值，需要对其进行验证以赋予他们必要的权限。你能给我一个执行此操作的示例代码吗？
I have a customer who is sending a Security key. The encryption they are using is triple DES. Every Assertion they send has a signature value which needs to be validated to give them necessary privileges. Can you give me a sample code which does this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
加密和签名是两种不同的动物。 Triple DES 是一种对称密钥方法（加密和解密使用相同的密钥）。另一方面，数字签名使用非对称密钥（私钥/公钥对），其中签名是使用私钥计算的，并且可以使用公钥进行验证。因此，如果您的客户想要在发送给您的 XML 中包含签名，那么他们需要向您提供他们的公钥。
对于加密，SAML 中的典型方法是使用 XMLEncryption，它定义了一种 XML 格式，用于在 SAML 消息中包含加密密钥信息和加密数据。由于静态对称密钥的交换是有问题的 - 如果它被拦截，拦截器可以加密和解密任何消息 - 可以做的是使用为每个消息重新生成的动态对称密钥，使用密钥，然后使用私有/公共加密密钥对的公共密钥加密该密钥，并将其与消息一起发送。加密的对称密钥只能使用用于加密的密钥对的私有部分来解密。
因此，从关键角度来看，这里最显着的区别是，对于签名，客户持有私钥并且必须与您共享公钥，而对于加密，您持有私钥并且必须与客户共享公钥。
Encryption and signing are two different animals. Triple DES is a symmetric key method (same key used for encryption and decryption). Digital signatures, on the other hand, use asymmetric keys (private/public key pair), where the signature is computed using the private key, and can be validated using the public key. So if your customer wants to include signatures in XML they send you, then they need to provide you with their public key.
For encryption, what is typical in SAML is to use XMLEncryption, which defines an XML format for including encryption key information and encrypted data in your SAML messages. Since exchange of a static symmetric key is problematic -- if it's intercepted, the interceptor can both encrypt and decrypt any messages -- what can be done instead is to use a dynamic symmetric key that gets generated anew for each message, encrypt the message using the key, then encrypt that key with the public key of a private/public encryption key pair and send it along with the message. The encrypted symmetric key can only be decrypted using the private half of the key pair used to encrypt it.
So the most significant difference here, from a key perspective, is that for signing, the customer holds the private key and must share the public key with you, while for encryption, you hold the private key and must share the public key with the customer.
如果您想验证 SAML 断言或任何可签名 XML 对象上的签名，OpenSAML WIKI 提供了更多信息：
https://wiki.shibboleth.net/confluence/plugins/viewsource/viewpagesrc.action?pageId=3277047
您可以查找“签名验证示例”。
这篇博文也有一个示例：
https:// blog.samlsecurity.com/2012/11/verifying-signatures-with-opensaml.html
要获取用于验证的“凭据”，请参阅此处：
https://blog.samlsecurity.com/2011/03/ getting-credentials-in-opensaml.html
有关如何将 XML 解组到 Open SAML 对象的信息，请参阅此处：
https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUsrManJavaCreateFromXML
If you want to validate the signature on the SAML Assertion or any of the Signable XML Objects, the OpenSAML WIKI has more information:
https://wiki.shibboleth.net/confluence/plugins/viewsource/viewpagesrc.action?pageId=3277047
You can look for 'Signature Verification Examples'.
This blog post also has an example as well:
https://blog.samlsecurity.com/2012/11/verifying-signatures-with-opensaml.html
To obtain a 'credential' for validation, see here:
https://blog.samlsecurity.com/2011/03/getting-credentials-in-opensaml.html
For info on how to unmarshal XML into an Open SAML object, see here:
https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUsrManJavaCreateFromXML