使用 pac4j-saml，如何根据 shiro.ini 设置获取 sp-metadata

【问题标题】：Using pac4j-saml, how do I get the sp-metadata based on shiro.ini setting使用 pac4j-saml，如何根据 shiro.ini 设置获取 sp-metadata
【发布时间】：2016-08-25 03:00:52
【问题描述】：

我需要在 EAR 应用程序中创建的各种 WAR 中执行 SSO。我遵循https://github.com/pac4j/buji-pac4j-demo 此处提供的演示，并以与演示中提供的完全相同的方式配置了 EAR 内每个 WAR 中的每个 shiro.ini。我正在使用资源：samlKeystore.jks（具有相同的凭据）并尝试连接相同的 okta（资源：metadata-okta.xml）IDP。但是，当我单击“SAML 保护的 url：saml/index.jsp”链接时，出现此错误：

2016-04-29 16:20:11,460 错误 [io.undertow.request]（默认任务 13）UT005023：对 /MyWebA/saml/index.jsp 的异常处理请求：javax.servlet.ServletException：org. pac4j.s​​aml.exceptions.SAMLException：密钥库没有私钥 在 org.apache.shiro.web.servlet.AdviceFilter.cleanup(AdviceFilter.java:196) 在 org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:148)

....

原因：org.pac4j.s​​aml.exceptions.SAMLException：Keystore 没有私钥 在 org.pac4j.s​​aml.crypto.KeyStoreCredentialProvider.getPrivateKeyAlias(KeyStoreCredentialProvider.java:175) 在 org.pac4j.s​​aml.crypto.KeyStoreCredentialProvider.(KeyStoreCredentialProvider.java:98) 在 org.pac4j.s​​aml.crypto.KeyStoreCredentialProvider.(KeyStoreCredentialProvider.java:105)

这很奇怪，因为我在资源文件夹中有实际的 samlKeystore.jks。

我的问题是：

1) 为什么即使我使用的是演示附带的相同密钥库，我也会收到“密钥库没有私钥”问题？顺便说一句，按原样运行演示没有这个问题。

2) 如果我想自己配置 IDP，我将需要描述我的 EAR 应用程序的 SP 元数据。我注意到 shiro.ini 将此配置设置为：saml2Config.serviceProviderMetadataPath = resource:sp-metadata.xml。但我可以找到 sp-metadata.xml（如果它打算生成一个）。如何使用 shiro.ini 生成 sp-metadata.xml？由于我使用的是 buji-pac4j 和 pac4j-saml，我无法弄清楚如何使用此处描述的 2 个选项来做到这一点https://github.com/pac4j/pac4j/wiki/Clients#saml-support

由 pom.xml 和 shiro.ini 编辑以包含

     <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
      <modelVersion>4.0.0</modelVersion>
      <parent>
        <groupId>MyEARProject</groupId>
        <artifactId>MyEARProject</artifactId>
        <version>0.0.1-SNAPSHOT</version>
      </parent>
      <groupId>MyEAR</groupId>
      <artifactId>MyEAR</artifactId>
      <packaging>ear</packaging>  
        <properties>
            <mywebversion>0.0.2</mywebversion>
            <pac4jVersion>1.8.8</pac4jVersion>
            <bujiVersion>1.4.2</bujiVersion>
            <javaVersion>1.8</javaVersion>
        </properties>   
      <dependencies>    
            <dependency>
                <groupId>io.buji</groupId>
                <artifactId>buji-pac4j-servlet</artifactId>
                <version>${bujiVersion}</version>
            </dependency>
            <dependency>
                <groupId>org.pac4j</groupId>
                <artifactId>pac4j-oauth</artifactId>
                <version>${pac4jVersion}</version>
            </dependency>
            <dependency>
                <groupId>org.pac4j</groupId>
                <artifactId>pac4j-openid</artifactId>
                <version>${pac4jVersion}</version>
            </dependency>
            <dependency>
                <groupId>org.pac4j</groupId>
                <artifactId>pac4j-cas</artifactId>
                <version>${pac4jVersion}</version>
            </dependency>
            <dependency>
                <groupId>org.pac4j</groupId>
                <artifactId>pac4j-http</artifactId>
                <version>${pac4jVersion}</version>
            </dependency>
            <dependency>
                <groupId>org.pac4j</groupId>
                <artifactId>pac4j-saml</artifactId>
                <version>${pac4jVersion}</version>
            </dependency>
            <dependency>
                <groupId>org.pac4j</groupId>
                <artifactId>pac4j-oidc</artifactId>
                <version>${pac4jVersion}</version>
            </dependency>
            <dependency>
                <groupId>org.pac4j</groupId>
                <artifactId>pac4j-gae</artifactId>
                <version>${pac4jVersion}</version>
            </dependency>
            <dependency>
                <groupId>org.pac4j</groupId>
                <artifactId>pac4j-ldap</artifactId>
                <version>${pac4jVersion}</version>
            </dependency>
            <dependency>
                <groupId>org.pac4j</groupId>
                <artifactId>pac4j-sql</artifactId>
                <version>${pac4jVersion}</version>
            </dependency>
            <dependency>
                <groupId>org.pac4j</groupId>
                <artifactId>pac4j-mongo</artifactId>
                <version>${pac4jVersion}</version>
            </dependency>
            <dependency>
                <groupId>org.pac4j</groupId>
                <artifactId>pac4j-stormpath</artifactId>
                <version>${pac4jVersion}</version>
            </dependency>
            <dependency>
                <groupId>ch.qos.logback</groupId>
                <artifactId>logback-classic</artifactId>
                <version>1.0.13</version>
            </dependency>

            <dependency>
                <groupId>javax.servlet</groupId>
                <artifactId>javax.servlet-api</artifactId>
                <version>3.0.1</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>javax.servlet.jsp</groupId>
                <artifactId>jsp-api</artifactId>
                <version>2.2</version>
                <scope>provided</scope>
            </dependency>
        <dependency>
            <groupId>net.sf.ehcache</groupId>
            <artifactId>ehcache-core</artifactId>
            <version>2.5.0</version>
        </dependency>
        <dependency>
             <groupId>org.apache.shiro</groupId>
             <artifactId>shiro-ehcache</artifactId>
             <version>1.2.4</version>
             <scope>provided</scope>
        </dependency    
            <dependency>
                <groupId>com.my</groupId>
                <artifactId>webApp1</artifactId>
                <version>${mywebversion}</version>
                <type>war</type>
            </dependency>
            <dependency>
                <groupId>com.my</groupId>
                <artifactId>webAppRest</artifactId>
                <version>${mywebversion}</version>
                <type>war</type>
            </dependency>
            <dependency>
                <groupId>com.my</groupId>
                <artifactId>webApp2</artifactId>
                <version>${mywebversion}</version>
                <type>war</type>
            </dependency>
      </dependencies> 
    </project>

这是我的 shiro.ini 配置

[main]
############################################################################
# PROVIDERS :
############################################################################
#sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
#sessionDAO = org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO
#sessionManager.sessionDAO = $sessionDAO
#cookie = org.apache.shiro.web.servlet.SimpleCookie
#cookie.name = SSOcookie
#cookie.path = /
#cookie.domain = localhost
#sessionManager.sessionIdCookie = $cookie
#securityManager.sessionManager = $sessionManager
#cacheManager = org.apache.shiro.cache.ehcache.EhCacheManager
#cacheManager.cacheManagerConfigFile = classpath:ehcache.xml
#securityManager.cacheManager = $cacheManager
#securityManager.sessionMode = native
#Para testing:
#ssl.enabled=false    
subjectFactory = io.buji.pac4j.ClientSubjectFactory
securityManager.subjectFactory = $subjectFactory    
facebookClient = org.pac4j.oauth.client.FacebookClient
facebookClient.key = 145278422258960
facebookClient.secret = be21409ba8f39b5dae2a7de525484da8    
twitterClient = org.pac4j.oauth.client.TwitterClient
twitterClient.key = CoxUiYwQOSFDReZYdjigBA
twitterClient.secret = 2kAzunH5Btc4gRSaMr7D7MkyoJ5u1VzbOOzE8rBofs    
simpleAuthenticator = org.pac4j.http.credentials.authenticator.test.SimpleTestUsernamePasswordAuthenticator    
formClient = org.pac4j.http.client.indirect.FormClient
formClient.loginUrl = http://localhost:8080/webApp1/loginForm.jsp
formClient.authenticator = $simpleAuthenticator    
basicAuthClient = org.pac4j.http.client.indirect.IndirectBasicAuthClient
basicAuthClient.authenticator = $simpleAuthenticator    
casClient = org.pac4j.cas.client.CasClient
casClient.casLoginUrl = https://casserverpac4j.herokuapp.com
#casClient.gateway=true    
vkClient = org.pac4j.oauth.client.VkClient
vkClient.key = 4224582
vkClient.secret = nDc4IHTqu8ioFMkHKifq    
saml2Config = org.pac4j.saml.client.SAML2ClientConfiguration
saml2Config.keystorePath = resource:samlKeystore.jks
saml2Config.keystorePassword = pac4j-demo-passwd
saml2Config.privateKeyPassword = pac4j-demo-passwd
saml2Config.identityProviderMetadataPath = resource:metadata-okta.xml
saml2Config.maximumAuthenticationLifetime = 3600
saml2Config.serviceProviderEntityId = http://localhost:8080/webApp1/callback?client_name=SAML2Client
saml2Config.serviceProviderMetadataPath = resource:sp-metadata.xml    
saml2Client = org.pac4j.saml.client.SAML2Client
saml2Client.configuration = $saml2Config    
clients = org.pac4j.core.client.Clients
clients.callbackUrl = http://localhost:8080/webApp1/callback
clients.clients = $facebookClient,$twitterClient,$formClient,$basicAuthClient,$casClient,$vkClient,$saml2Client    
############################################################################
# REALM & FILTERS :
############################################################################
clientsRealm = io.buji.pac4j.ClientRealm
clientsRealm.defaultRoles = ROLE_USER
clientsRealm.clients = $clients    
clientsFilter = io.buji.pac4j.ClientFilter
clientsFilter.clients = $clients
clientsFilter.failureUrl = /error500.jsp    
facebookRoles = io.buji.pac4j.filter.ClientRolesAuthorizationFilter
facebookRoles.client = $facebookClient
twitterRoles = io.buji.pac4j.filter.ClientRolesAuthorizationFilter
twitterRoles.client = $twitterClient
formRoles = io.buji.pac4j.filter.ClientRolesAuthorizationFilter
formRoles.client = $formClient
basicAuthRoles = io.buji.pac4j.filter.ClientRolesAuthorizationFilter
basicAuthRoles.client = $basicAuthClient
casRoles = io.buji.pac4j.filter.ClientRolesAuthorizationFilter
casRoles.client = $casClient
vkRoles = io.buji.pac4j.filter.ClientRolesAuthorizationFilter
vkRoles.client = $vkClient
saml2Roles = io.buji.pac4j.filter.ClientRolesAuthorizationFilter
saml2Roles.client = $saml2Client    
[urls]
/facebook/** = facebookRoles[ROLE_USER]
/twitter/** = twitterRoles[ROLE_USER]
/form/** = formRoles[ROLE_USER]
/basicauth/** = basicAuthRoles[ROLE_USER]
/cas/** = casRoles[ROLE_USER]
/vk/** = vkRoles[ROLE_USER]
/saml/** = saml2Roles[ROLE_USER]
/callback = clientsFilter
/logout = logout
/** = anon

因为我想在 EAR 中的各种 WAR 中执行 SSO，所以我最初添加了 EhCacheManager，但后来出现以下错误。

2016-05-01 22:03:38,126 INFO  [org.apache.shiro.web.env.EnvironmentLoader] (ServerService Thread Pool -- 163) Starting Shiro environment initialization.
2016-05-01 22:03:38,179 ERROR [org.apache.shiro.web.env.EnvironmentLoader] (ServerService Thread Pool -- 163) Shiro environment initialization failed: org.apache.shiro.config.ConfigurationException: Unable to instantiate class [org.apache.shiro.cache.ehcache.EhCacheManager] for object named 'cacheManager'.  Please ensure you've specified the fully qualified class name correctly.
    at org.apache.shiro.config.ReflectionBuilder.createNewInstance(ReflectionBuilder.java:151)
    at org.apache.shiro.config.ReflectionBuilder.buildObjects(ReflectionBuilder.java:119)
    at org.apache.shiro.config.IniSecurityManagerFactory.buildInstances(IniSecurityManagerFactory.java:161)
    at org.apache.shiro.config.IniSecurityManagerFactory.createSecurityManager(IniSecurityManagerFactory.java:124)
    at org.apache.shiro.config.IniSecurityManagerFactory.createSecurityManager(IniSecurityManagerFactory.java:102)
    at org.apache.shiro.config.IniSecurityManagerFactory.createInstance(IniSecurityManagerFactory.java:88)
    at org.apache.shiro.config.IniSecurityManagerFactory.createInstance(IniSecurityManagerFactory.java:46)
    at org.apache.shiro.config.IniFactorySupport.createInstance(IniFactorySupport.java:123)
    at org.apache.shiro.util.AbstractFactory.getInstance(AbstractFactory.java:47)
    at org.apache.shiro.web.env.IniWebEnvironment.createWebSecurityManager(IniWebEnvironment.java:203)
    at org.apache.shiro.web.env.IniWebEnvironment.configure(IniWebEnvironment.java:99)
    at org.apache.shiro.web.env.IniWebEnvironment.init(IniWebEnvironment.java:92)
    at org.apache.shiro.util.LifecycleUtils.init(LifecycleUtils.java:45)
    at org.apache.shiro.util.LifecycleUtils.init(LifecycleUtils.java:40)
    at org.apache.shiro.web.env.EnvironmentLoader.createEnvironment(EnvironmentLoader.java:221)
    at org.apache.shiro.web.env.EnvironmentLoader.initEnvironment(EnvironmentLoader.java:133)
    at org.apache.shiro.web.env.EnvironmentLoaderListener.contextInitialized(EnvironmentLoaderListener.java:58)
    at io.undertow.servlet.core.ApplicationListeners.contextInitialized(ApplicationListeners.java:187)
    at io.undertow.servlet.core.DeploymentManagerImpl.deploy(DeploymentManagerImpl.java:198)
    at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:100)
    at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:82)
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
    at java.util.concurrent.FutureTask.run(FutureTask.java:266)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at java.lang.Thread.run(Thread.java:745)
    at org.jboss.threads.JBossThread.run(JBossThread.java:320)
Caused by: org.apache.shiro.util.UnknownClassException: Unable to load class named [org.apache.shiro.cache.ehcache.EhCacheManager] from the thread context, current, or system/application ClassLoaders.  All heuristics have been exhausted.  Class could not be found.
    at org.apache.shiro.util.ClassUtils.forName(ClassUtils.java:148)
    at org.apache.shiro.util.ClassUtils.newInstance(ClassUtils.java:164)
    at org.apache.shiro.config.ReflectionBuilder.createNewInstance(ReflectionBuilder.java:144)
    ... 26 more

Buji-pac4j 是否适用于带有 WAR 的 SSO 的 EhCache 配置？

【问题讨论】：

    标签： java apache saml cas shiro


    【解决方案1】：

    对于（2），我发现在shiro.ini的[main]部分设置以下条目会在我处理saml请求时在web项目的根文件夹中生成一个文件“sp-metadata.xml” ：

    saml2Config.serviceProviderMetadataPath = sp-metadata.xml
saml2Config.forceServiceProviderMetadataGeneration = true

    对于 (1)，听起来类路径中没有放置密钥库。我发现的一个附注：我的项目处理资源文件夹与 src 文件夹不同，因为它过滤了资源。这损坏了密钥库，直到我将密钥库移动到 src 文件夹。

    【讨论】：

      【解决方案2】：

      1）我从来没有遇到过这个错误，看起来很奇怪。可以尝试使用最新的pac4j-saml版本，我是说1.8.8，私钥选择算法已经改进了吗？

      2) SP 元数据根据您定义的 SAML2Configuration 生成，并基于 serviceProviderMetadataPath 属性定位。更改 SAML2Configuration 以生成适当的配置

      【讨论】：

      • 您好 Jleleu，我已更改为 1.8.8，但仍然没有运气 - 2 个问题仍然存在。我编辑了我的原始帖子以包含我的 pom.xml 和 shiro.ini。由于我想使用 EAR 中的 WAR 进行 SSO，因此我配置了 EhCache，但只是为了得到上述错误。 EhCache 是否可以通过 buji-pac4j 进行配置？
      • buji-pac4j 依赖于 Shiro 会话，所以你应该可以使用 EhCache
      猜你喜欢
      • 2017-02-25
      • 2021-06-10
      • 2023-03-19
      • 1970-01-01
      • 1970-01-01
      • 2016-07-08
      • 2018-11-12
      • 2013-04-06
      • 1970-01-01
      相关资源
      最近更新 更多
      热门标签
      Java Python linux javascript Mysql C# Docker 算法 前端 SpringBoot Redis Vue spring 设计模式 .net core .net kubernetes c++ 数据库 数据结构 大数据 js 机器学习 微服务 Android Go 程序员 面试 JVM ASP.net core 云原生 人工智能 后端 PHP git CSS golang k8s Nginx Django mybatis 深度学习 多线程 React 架构 devops 爬虫 云计算 Spring Boot LeetCode