ADFS 2.0。弄清楚每个 X.509 证书的用途和价值
我对所有这些安全功能都不熟悉，最近我被要求研究 ADFS 2.0。我发现 ADFS 使用以下类型的 X.509 证书与依赖方 (RP) 进行通信：
- 对于所有 RP 通用： 1）服务沟通 2) 令牌签名 Token解密
- 3） RP专用的 ： 4) 加密证书
请帮助我找出在涉及所有 3 个部分的现实生产场景中哪一个是真正重要和需要的：用户、服务提供商（我们公司）、IdP（ADFS）（在客户的服务器上） 。
1) 我在 MS 帮助中发现了有关第一个证书的信息：“这是联合服务器在 Internet 信息服务 (IIS) 中用作 SSL 证书的同一证书”我不确定这是真的，因为我能够单独替换它们不会互相影响，因此它们肯定可以并行运行。所以不知道这个证书有什么用。
2) 第二个是用于注册已发行的代币，以便 RP 能够确保该代币确实是由受信任的 ADFS 发行的，而不是被拦截的，对吗？
3) 第三个可能用于相反的目的：ADFS 确保消息确实来自受信任的 RP。
4）特定RP的加密证书有助于加密整个消息（令牌），这样即使您获得了https公钥并从ADFS拦截了消息，您也无法在没有其他应该只有RP知道的公钥的情况下读取它，正确的？
如果我错了请纠正我。
所有这些证书都是可选的，微软没有提及其重要性，我在 WIF SDK 中唯一提到的帮助说最好在现实生活中使用令牌加密证书。问题是我们为 ADFS-RP 通信建立了 HTTPS 协议（IIS 设置为在双方都使用 https）。安全通信还不够吗？我想知道：我们真的需要 2)、3) 甚至 4) 吗？
I'm new to all this security features, and recently I was asked to look into ADFS 2.0. I found ADFS uses the following types of X.509 certificates to communicate with Relying Party (RP):
- Common for all RPs:
1) Service communication
2) Token-signing
3) Token-decrypting - Specific for RP:
4) Encryption certificate
Help me out please to figure out which one is really important and needed in a real-life production scenario where all 3 parts are involved: user, service provider (our company), IdP(ADFS) (on customer's server).
1) What I found regarding first certificate in MS help: "This is the same certificate that a federation server uses as the SSL certificate in Internet Information Services (IIS)" I'm not sure it's true coz I was able to replace them separately not affecting each other so they definitely might function in parallel. So no idea what this certificate is needed for.
2) Second one is for signing up issued tokens so that RP is able to make sure the token is really issued by trusted ADFS, not intercepted, right?
3) Third one is probably for reverse purposes: ADFS makes sure the message is really from trusted RP.
4) Encryption certificate for specific RP helps encrypt whole message (token), so that even if you got https public key and intercept a message from ADFS, you can not read it not having other public key which supposed to be only know to RP, correct?
Correct me if I'm wrong please.
All this certificates are optional and Micorosoft says nothing about importance of which, the only mention I cound in WIF SDK help saying it's better to use token encryption certificate in real life. The thing is we have HTTPS protocol being established for ADFS-RP communication (IIS is set up to use https on both sides). Is not it enough for secure communication? I wonder: do we really need 2), 3) and even 4)?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
在现实生活中，您至少有两个：
1.) SSL 证书 - 现在只是常识，并且由 SAML 2.0 SSO 配置文件。这可能是与前端 ADFS 的 IIS 相同的证书。
2.) 令牌签名/验证（不是“解密”）证书 - 需要符合使用“前端通道 绑定"（HTTP 重定向/POST）。如果您是身份提供商 (IdP)，那么您将拥有私有签名密钥 - 如果不是，则只有证书（带有公共验证密钥）。事实上，这是为了验证断言是由受信任的一方发出的，并且未被篡改。这对于联盟来说绝对至关重要，否则任何人都可以侵入您的环境（作为 SP (RP)）。
加密证书确实会用于加密 SAML 消息的某些部分 - 如果您试图隐藏可能通过用户浏览器传递的信息（例如 SAML 断言的属性语句中的敏感属性），这种情况很常见。
In a real life scenario, you have at least two:
1.) SSL certificate - just common sense nowadays, and recommended by the SAML 2.0 SSO profile. This could be the same certificate as IIS that's front-ending ADFS.
2.) Token signing / verification (not "decrypting") certificate - required to conform to SAML 2.0 profiles that use "front channel bindings" (HTTP Redirect/POST). If you're the Identity Provider (IdP) then you'll have the private signing key - if not, just the certificate (w public verification key). Indeed this is to verify that the assertions have been issued by a trusted party, and not tampered with. It is absolutely critical for federation otherwise anyone can forge their way into your environment (as the SP (RP)).
An encryption certificate would indeed be used to encrypt portions of your SAML messages - which is common if you're trying to hide information that may be passed via a user's browser (like sensitive attributes within a SAML Assertion's Attribute Statement).
1 和 2 是强制性的。
如果不是 https 连接，ADFS 不会让您通过导入元数据来添加 RP 绑定。
声明的定义是“关于某个主体的声明；例如，一个主体对其自身或另一个主体做出的名称、身份、密钥、组、权限或能力。声明被赋予一个或多个值，然后打包在由安全令牌服务 (STS) 颁发的安全令牌中”。为了确保令牌的有效性，需要对其进行签名。
令牌本身是否加密取决于安全要求。
1 and 2 are mandatory.
ADFS will not let you add a RP binding via importing metadata if it's not a https connection.
The definition of a claim is "A statement about a subject; for example, a name, identity, key, group, permission, or capability, made by one subject about itself or another subject. Claims are given one or more values and then packaged in security tokens that are issued by a security token service (STS)". To ensure the validity of the token it needs to be signed.
Whether the token itself is encrypted depend on the security requirements.