Question

我正在尝试为SalesForce做“SAML 2.0 Bearer Assertion”

我收到{“error”：“invalid_grant”，“error_description”：“无效断言”}

有没有办法在salesforce上验证承载断言？

我在我的代码中做了以下

String environment = "https://login.salesforce.com/services/oauth2/token?saml=MgoTx78aEPRbRaz0CkRqjaqrhP3sCa7w7.Y5wbrpGMNT07zKRYwcNWf0zs";
Map<String, String> map = new HashMap<String, String>();
HttpClient httpclient = new HttpClient();
PostMethod post = new PostMethod(environment);
post.addParameter("grant_type", "urn:ietf:params:oauth:grant-type:saml2-bearer");
post.addParameter("client_assertion", Base64.encode(samlResponse.getBytes()));
post.addParameter("client_assertion_type","urn:ietf:params:oauth:client_assertion_type:saml2-bearer");

post.addParameter("format", "json");
    String accessToken= null;
    String instanceUrl = null;
    try {
        httpclient.executeMethod(post);
        JSONObject authResponse = new JSONObject(new JSONTokener(new InputStreamReader(post.getResponseBodyAsStream())));
        System.out.println(authResponse.toString());


    } catch (Exception e) {
        e.printStackTrace();
    } finally {
        post.releaseConnection();
    }

我已经生成了以下断言

<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
ID="s2d3a451cf30560ca819118cf5785e722ea6da7b64" IssueInstant="2012-03-06T12:34:13Z"
Version="2.0">
<saml:Issuer>http://localhost:8080/opensso
</saml:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:SignedInfo>
        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
        <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
        <ds:Reference URI="#s2d3a451cf30560ca819118cf5785e722ea6da7b64">
            <ds:Transforms>
                <ds:Transform
            Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
            </ds:Transforms>
            <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
            <ds:DigestValue>seHyxsFzsHCs0GaY7usF0DfMV58=
            </ds:DigestValue>
        </ds:Reference>
    </ds:SignedInfo>
    <ds:SignatureValue> signature.....</ds:SignatureValue>
    <ds:KeyInfo>
        <ds:X509Data>
            <ds:X509Certificate> certificate.....</ds:X509Certificate>
        </ds:X509Data>
    </ds:KeyInfo>
</ds:Signature>
<saml:Subject>
    <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
        NameQualifier="http://localhost:8080/opensso" SPNameQualifier="https://saml.salesforce.com">deepakmule</saml:NameID>
    <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
        <saml:SubjectConfirmationData
            NotOnOrAfter="2012-03-06T12:44:13Z"
            Recipient="https://login.salesforce.com/?saml=MgoTx78aEPRbRaz0CkRqjaqrhP3sCa7w7.Y5wbrpGMNT07zKRYwcNWf0zs" />
    </saml:SubjectConfirmation>
</saml:Subject>
<saml:Conditions NotBefore="2012-03-06T12:34:13Z"
    NotOnOrAfter="2012-03-06T12:44:13Z">
    <saml:AudienceRestriction>
        <saml:Audience>https://saml.salesforce.com</saml:Audience>
    </saml:AudienceRestriction>
</saml:Conditions>
<saml:AuthnStatement AuthnInstant="2012-03-06T12:34:13Z"
    SessionIndex="s27fb03a2b73bd8dc6846851bed7885b85e1d9ed6f">
    <saml:AuthnContext>
        <saml:AuthnContextClassRef>             urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
        </saml:AuthnContextClassRef>
    </saml:AuthnContext>
</saml:AuthnStatement>
<saml:AttributeStatement>
    <saml:Attribute Name="userid">
        <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">deepakmule</saml:AttributeValue>
    </saml:Attribute>
</saml:AttributeStatement>
</saml:Assertion>

Answer 1

您是否尝试使用与为组织配置SSO相同的IDP，或者您是否尝试使用添加到远程访问应用程序的证书？

如果您正在尝试使用SSO配置，那么这看起来相当不错 - 我会检查SAML断言验证器

如果您尝试将Bearer流与远程访问应用程序一起使用，那么我将查看以下内容

1）发卡行应该是来自远程访问应用程序的消费者密钥（oauth client_id）

2）发布到我们的常规令牌端点

3）使用salesforce用户名作为主题

4）将断言的生命周期缩短到一分钟

SalesForce.com的SAML 2.0 Bearer Assertion的无效断言

1 个答案: