如何在ASP.NET MVC中创建单符号身份提供商服务器？
我是SSO和SAML的新手。我们有一个ASP.NET MVC服务器。我们需要使其充当SSO 身份提供商，该提供商接受A SAML请求我们的其他服务提供商我们的网站，允许用户登录使用电子邮件，密码和2FA，然后使用 SAML响应/断言将其重定向回到服务提供商网站。
使用DNN CMS创建了两个服务提供商网站，因此我们的 sso Identity提供商工作必须是行业标准，以便DNN CMS可以使用它。
问题：
- 如何在服务提供商方面创建 SAML请求？我可以使用什么工具来创建XML？
- 如何加密 SAML请求？对称还是不对称？使用什么加密密钥？它可以签名吗？
- 如何将 SAML请求发送到身份提供商？获取还是帖子？作为查询字符串？查询字符串名称是什么？
- 如何解密 saml请求 身份提供商方面？如何验证其签名的签名？
- 如何在身份提供商方面创建 SAML响应/断言？
- 如何加密和签署响应？
- 如何将 SAML响应发送回服务提供商？获取还是张贴？作为查询字符串？什么查询字符串名称？
- 如何解密和验证 SAML响应服务提供商方面？
- 如何从 SAML响应中提取信息？
I am quite new to SSO and SAML. We have an ASP.NET MVC server. We need to make it act as a SSO identity provider, which accepts a SAML request from other service provider websites of ours, lets users to login using email, password and 2FA, then redirect back to the service provider websites with a SAML response/assertion.
Two of the service provider websites are created using DNN CMS, so the way our SSO identity provider works must be industry-standard, so that DNN CMS can work with it.
Questions:
- How to create the SAML request on the service provider side? What tool I can use to create the XML?
- How to encrypt the SAML request? Symmetric or asymmetric? What encryption key to use? Shall it be signed?
- How to send the SAML request to the identity provider? A GET or POST? As query string? What is the query string name?
- How to decrypt the SAML request on the identity provider side? How to verify the signature it it is signed?
- How to create the SAML response/assertion on the identity provider side?
- How to encrypt and sign the response?
- How to send the SAML response back to the service provider? GET or POST? As a query string? What query string name?
- How to decrypt and verify the SAML response on the service provider side?
- How to extract information from the SAML response?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我强烈建议使用商业产品或开源库。试图自己实施这一问题并正确实现安全性是一项重大任务。
可以通过查看SAML V2.0规范文档来回答您的大多数问题。如果您确实决定尝试自己实施此功能，这也将使您了解所涉及的工作。
I strongly recommend either using a commercial product or open source library. Attempting to implement this yourself and getting the security correct is a major undertaking.
Most of your questions can be answered by looking at the SAML v2.0 specification documents. This will also give you an idea of the work involved if you did decide to attempt implementing this yourself.
我找到了答案。
本文档回答了我列出的所有问题，以及以下供应商， www.componentspace.com ，是一个很好的很好可用于创建IDP和SP的已知和知名SDK。
I found the answer.
This document answers all the questions I listed, and the following supplier, www.componentspace.com, is a well-known and reputed SDK that can be used to create both a IdP and SP.
您可以将 minorange nuget软件包用于此目的。
我已经成功地将SSO + MFA实施到了ASP.NET应用程序中。
链接： https://plugins.miniorange.com/asp.net
You can use the miniOrange NuGet package for this purpose.
I've successfully implemented SSO + MFA into ASP.NET Applications using their solutions.
LINK: https://plugins.miniorange.com/asp.net