处理 SAML 断言是如何工作的？
我需要成为 SAML 解决方案中的服务提供商，并且想了解断言的处理是如何工作的。我在此处找不到答案。
我想断言会这样说：“我是 John Doe，我的 ID 是：999”？我是否需要与身份提供商“同步”的用户列表？我是否需要一个与 SAML 断言具有相同 ID 的访问控制列表？
场景：我有一个带有 ACL 的数据库。我将成为服务提供商，而远程第三方系统将成为身份提供商。
我不明白远程系统如何知道我的访问控制列表中有哪些用户能够授权任何人。
I need to be the service provider in a SAML solution and want to know how the processing of assertions work. I could not find the answer here.
I imagine the assertion would say something like: "I'm John Doe, My ID is: 999"? Do i need an User list that is "in Sync" with the identity provider? Do i need an Access Control list has the same ID's as the SAML Assertions?
Scenario: I have a database with ACL's. I will be the Service Provider while a remote 3rd party system will be the identity provider.
I don't understand how a remote system would know what users i have in my Access Control lists to be able to authorize anyone.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
SAML 规范本身并未涵盖 IdP 处的用户 ID 与 SP 处的用户之间的映射。我建议您查看 SAML 概述。这应该可以帮助您确定最适合您的场景的方法。
对于我工作的系统（作为多个客户端/IdP 的 SP），我们有一种机制，客户端可以通过该机制将自己的标识符与我们系统上的用户相关联；该机制不属于 SAML 实现范围。当客户端向我们发送 SAML 断言时，我们希望这些断言能够使用这些标识符来识别用户（以及使用另一个共享标识符来识别客户端本身）。
The mapping between user ids at the IdP and users at the SP is not covered by the SAML spec itself. I'd suggest you look at section 5.4, "Establishing and Managing Federated Identities", in SAMLOverview. That should help you determine the most appropriate approach for your scenario.
For the system I work on (which serves as SP for multiple clients/IdPs), we have a mechanism by which clients can associate their own identifiers with users on our system; this mechanism is outside of the SAML implementation. When clients send us SAML assertions, we expect those assertions to identify users using those identifiers (as well as identifying the client themselves using another shared identifier).