验证 SAML 响应

Question

我有一个 SAML 响应和一些其他数据。基于此，我需要验证响应是否被篡改。我该怎么做？

我有什么？

1. 带有签名消息和断言的 SAML 响应

2. IdP EntityId

3. SP 实体标识

4. SP ACS 端点

5. 目标网址

6. X509 格式的 IdP 证书。

需要语言：JAVA

Answer 1

找到了解决办法。如果有人在寻找它。

try {
            InputStream is = new FileInputStream("<CERTIFICATE FILE>");
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            Certificate cert = cf.generateCertificate(is);
            X509Certificate x509Certificate = (X509Certificate) cert;
            PublicKey pk = x509Certificate.getPublicKey();
            BasicX509Credential publicCredential = new BasicX509Credential();
            publicCredential.setPublicKey(pk);
            SignatureValidator signatureValidator = new SignatureValidator(publicCredential);
            SignableSAMLObject signableSAMLObject = (SignableSAMLObject) <XML OBJECT>;
            Signature signature = signableSAMLObject.getSignature();
            signatureValidator.validate(signature);
        }catch(Exception ex){
            // fail this.
        }

可以通过以下方式使用编组器从 SAML 消息中获取 XML 对象：

String encodedMessage = request.getParameter(PARAM_SAML);
String decodedMessage = new String(Base64.decodeBase64(encodedMessage.getBytes()));
DefaultBootstrap.bootstrap();
BasicParserPool ppMgr = new BasicParserPool();
ppMgr.setNamespaceAware(true);
Document responseRoot = ppMgr.parse(new StringReader(decodedMessage));
UnmarshallerFactory unmarshallFactory = Configuration.getUnmarshallerFactory();
Unmarshaller unmarshaller = unmarshallFactory.getUnmarshaller(responseRoot.getDocumentElement());
XMLObject obj = unmarshaller.unmarshall(responseRoot.getDocumentElement());