ITfoxtec SAML 2.0 加密断言答案

【问题标题】：ITfoxtec SAML 2.0 encrypt assertionITfoxtec SAML 2.0 加密断言
【发布时间】：2018-11-26 23:20:02
【问题描述】：

是否可以使用 ITfoxtec Identity Saml2（开源 - https://itfoxtec.com/identitysaml2）加密断言响应？什么都没找到。

GitHub 站点 (https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2) 提到了解密而不是加密。似乎也没有任何关于加密的示例。

感谢任何帮助。谢谢。

【问题讨论】：

标签： encryption saml-2.0 itfoxtec-identity-saml2

【解决方案1】：

在 saml2postbinding 类中，将 BindInternal 方法替换为以下代码。

protected override Saml2PostBinding BindInternal(Saml2Request saml2RequestResponse, string messageName)
    {
        BindInternal(saml2RequestResponse);

        var element1 = XmlDocument.CreateElement("saml2", "EncryptedAssertion", "urn:oasis:names:tc:SAML:2.0:assertion");
        XmlDocument xmlDoc = new XmlDocument();
        var assertionElements = XmlDocument.DocumentElement.SelectNodes($"//*[local-name()='{Saml2Constants.Message.Assertion}']");
        var assertionElement = (assertionElements[0] as XmlElement).ToXmlDocument().DocumentElement;
        var certificate = ITfoxtec.Identity.Saml2.Util.CertificateUtil.Load(@"F:\IT-FoxTec-Core Copy\ITfoxtec.Identity.Saml2-master (1)\ITfoxtec.Identity.Saml2-master\test\TestIdPCore\itfoxtec.identity.saml2.testwebappcore_Certificate.crt");



        var wrappedAssertion = $@"<saml2:EncryptedAssertion xmlns:saml2=""urn:oasis:names:tc:SAML:2.0:assertion"">{assertionElement.OuterXml}</saml2:EncryptedAssertion>";
        xmlDoc.LoadXml(wrappedAssertion);
        var elementToEncrypt = (XmlElement)xmlDoc.GetElementsByTagName("Assertion", Saml2Constants.AssertionNamespace.OriginalString)[0];
        element1.InnerXml = wrappedAssertion.ToXmlDocument().DocumentElement.SelectNodes($"//*[local-name()='{Saml2Constants.Message.Assertion}']")[0].OuterXml;
        var element2 = wrappedAssertion.ToXmlDocument().DocumentElement;
        var childNode = XmlDocument.GetElementsByTagName("Assertion", Saml2Constants.AssertionNamespace.OriginalString)[0];
        XmlDocument.DocumentElement.RemoveChild(childNode);
        var status = XmlDocument.DocumentElement[Saml2Constants.Message.Status, Saml2Constants.ProtocolNamespace.OriginalString];
        XmlDocument.DocumentElement.InsertAfter(element1, status);




        if (certificate == null) throw new ArgumentNullException(nameof(certificate));

        var encryptedData = new EncryptedData
        {
            Type = EncryptedXml.XmlEncElementUrl,
            EncryptionMethod = new EncryptionMethod(EncryptedXml.XmlEncAES256Url)
        };

        var algorithm = true ? EncryptedXml.XmlEncRSAOAEPUrl : EncryptedXml.XmlEncRSA15Url;
        var encryptedKey = new EncryptedKey
        {
            EncryptionMethod = new EncryptionMethod(algorithm),
        };

        var encryptedXml = new EncryptedXml();
        byte[] encryptedElement;
        using (var encryptionAlgorithm = new AesCryptoServiceProvider())
        {
            encryptionAlgorithm.KeySize = 256;

            encryptedKey.CipherData = new CipherData(EncryptedXml.EncryptKey(encryptionAlgorithm.Key, (RSA)certificate.PublicKey.Key, true));
            encryptedElement = encryptedXml.EncryptData(elementToEncrypt, encryptionAlgorithm, false);
        }
        encryptedData.CipherData.CipherValue = encryptedElement;



        encryptedData.KeyInfo = new KeyInfo();
        encryptedData.KeyInfo.AddClause(new KeyInfoEncryptedKey(encryptedKey));
        EncryptedXml.ReplaceElement((XmlElement)xmlDoc.GetElementsByTagName("Assertion", Saml2Constants.AssertionNamespace.OriginalString)[0], encryptedData, false);
        EncryptedXml.ReplaceElement((XmlElement)XmlDocument.GetElementsByTagName("Assertion", Saml2Constants.AssertionNamespace.OriginalString)[0], encryptedData, false);

        if ((!(saml2RequestResponse is Saml2AuthnRequest) || saml2RequestResponse.Config.SignAuthnRequest) && saml2RequestResponse.Config.SigningCertificate != null)
        {
            Cryptography.SignatureAlgorithm.ValidateAlgorithm(saml2RequestResponse.Config.SignatureAlgorithm);
            XmlDocument = XmlDocument.SignDocument(saml2RequestResponse.Config.SigningCertificate, saml2RequestResponse.Config.SignatureAlgorithm, CertificateIncludeOption, saml2RequestResponse.Id.Value);

        }
        PostContent = string.Concat(HtmlPostPage(saml2RequestResponse.Destination, messageName));
        return this;
    }

这里的证书是任何依赖方的公钥证书。

【讨论】：

【解决方案2】：

很抱歉，目前不支持断言响应加密。

欢迎您在缺少的加密功能上创建issue。如果您实现该功能，请分享代码。

【讨论】：

真可惜。谢谢你告诉我。