Question

我正在摸索一个似乎适用于IE和Chrome的特殊问题。

我们有一个为RP服务的定制无源STS。一切顺利，直到我通过我的自定义身份验证服务进行身份验证，然后STS返回我可以在我的临时文件夹中看到的令牌。然后发送SAML 1.0令牌的POST操作挂起并静默死亡而不是取回通常会重定向RP的FedAuth cookie

注意：RP和IP托管在反向代理服务器（Nginx）后面的Web服务器上。反向代理通过SSL托管，来往代理服务器和Web服务器的所有流量均为非SSL

以下内容登录网络服务器

Event code: 3005 
Event message: An unhandled exception has occurred. 
Event time: 12/11/2013 5:16:33 PM 
Event time (UTC): 12/11/2013 5:16:33 PM 
Event ID: eef80ad2bffe425780dd46e5f28c0306 
Event sequence: 2 
Event occurrence: 1 
Event detail code: 0 


Exception information: 
Exception type: XmlException 
Exception message: **Unexpected end of file. Following elements are not closed:   RequestedUnattachedReference, RequestSecurityTokenResponse,** RequestSecurityTokenResponseCollection. Line 1, position 5852.

at System.Xml.XmlExceptionHelper.ThrowXmlException(XmlDictionaryReader reader, String res, String arg1, String arg2, String arg3)
at System.Xml.XmlExceptionHelper.ThrowUnexpectedEndOfFile(XmlDictionaryReader reader)
at System.Xml.XmlBufferReader.GetByteHard()
at System.Xml.XmlBufferReader.GetByte()
at System.Xml.XmlUTF8TextReader.ReadStartElement()
at System.Xml.XmlUTF8TextReader.Read()
at System.Xml.XmlBaseReader.ReadEndElement()
at   Microsoft.IdentityModel.Protocols.WSTrust.WSTrustSerializationHelper.ReadRSTRXml(XmlReader reader, RequestSecurityTokenResponse rstr, WSTrustSerializationContext context, WSTrustConstantsAdapter trustConstants)
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrust13ResponseSerializer.ReadXmlElement(XmlReader reader, RequestSecurityTokenResponse rstr, WSTrustSerializationContext context)
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustSerializationHelper.CreateResponse(XmlReader reader, WSTrustSerializationContext context, WSTrustResponseSerializer responseSerializer, WSTrustConstantsAdapter trustConstants)
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrust13ResponseSerializer.ReadXml(XmlReader reader, WSTrustSerializationContext context)
at Microsoft.IdentityModel.Protocols.WSFederation.WSFederationSerializer.CreateResponse(WSFederationMessage message, WSTrustSerializationContext context)
at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.GetXmlTokenFromMessage(SignInResponseMessage message, WSFederationSerializer federationSerializer)
at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.GetXmlTokenFromMessage(SignInResponseMessage message)
at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.GetXmlTokenFromMessage(SignInResponseMessage message, WSFederationSerializer federationSerializer)
at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.GetSecurityToken(SignInResponseMessage message)
at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.GetSecurityToken(HttpRequest request)
at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.SignInWithResponseMessage(HttpRequest request)
at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args)
at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

我不明白为什么只是为了我得到这个问题。 FF标题中发送的内容大小是否有限制？

另一个问题是：我在代理服务器（SSL）上安装了两个不同的证书，在Web服务器（STS）上安装了一个证书来签署令牌。我可以使用相同的证书吗？我应该吗？

Answer 1

根据问题Can HTTP headers be too big for a browser的最高投票答案，Firefox确实具有最低的个人标题大小（或至少在FF3.6中回复）。接受的答案可能对您有所帮助，但正如您所提到的那样，您已经落后于代理人。

在到达STS后，没有Fedauth cookie作为SAML令牌发送回来似乎错过了XML标签。仅在Firefox上发生

1 个答案: