主题

SAML ​

SAML2.0简介 ​

安全声明标记语言2.0（SAML 2.0）是SAML标准的一个版本，用于在安全域间交换身份验证和授权身份。它使用包含断言的安全性令牌在名为Identity Profile的SAML授权和名为Service Profile的SAML使用者之间传递有关主体（通常是最终用户）的信息。

SAML2.0集成 ​

IDS7（CIAP）产品通过cas5.3.14认证授权架构支持SAML2.0协议。这里提供支持Web browser SSO profile绑定模式的集成方案，即SAML 2.0指定了一个Web浏览器SSO配置文件，其中包含身份提供者（IdP），服务提供者（SP）和使用HTTP用户代理的委托人。

下图是SAML2.0 Web浏览器SSO配置文件（SAMLProf）的相对简单的部署，其中服务提供商（SP）和身份提供商（IdP）都使用HTTP POST绑定。

saml.png

1. 在SP处请求目标资源 ​

其实就是校验系统session。

委托人（通过HTTP用户代理）在服务提供者处请求目标资源：

 https://sp.example.com/xxx

服务提供商代表目标资源执行安全检查。如果服务提供商处已经存在有效的安全上下文，请跳过步骤2-7。

2. 用XHTML表单回应 ​

备注：可以在由前台页面提交，也可以后台模拟post 请求

服务提供者以包含XHTML表单的文档作为响应：

 <form method="post" action="https://idp.example.org/SAML2/SSO/POST"    >
    <input type="hidden" name="SAMLRequest" value="request" />
    <input type="submit" value="Submit" />
 </form>

SAMLRequest参数的值是以下samlp:AuthnRequest元素的base64编码：

 <samlp:AuthnRequest
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    ID="identifier_1"
    Version="2.0"
    IssueInstant="2004-12-05T09:21:59Z"
    AssertionConsumerServiceIndex="0">
    <saml:Issuer>https://sp.example.com/SAML2</saml:Issuer>
    <samlp:NameIDPolicy
      AllowCreate="true"
    Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
 </samlp:AuthnRequest>

*下面提供示例（仅供参考）：

reqHead.png

req.png

SAMLRequest参数的值是以下xml串的base64编码值

<?xml version="1.0" encoding="UTF-8"?>
    <saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" 
    AssertionConsumerServiceURL="http://客户端域名/sp/saml/SSO" 
    Destination="http://认证端域名/authserver/idp/profile/SAML2/POST/SSO" 
    ForceAuthn="false" ID="a3105d0h98823c0e21b2f7c00ee274i" IsPassive="false" 
    IssueInstant="2020-05-11T06:53:54.257Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">

	<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://客户端域名/sp/.*</saml2:Issuer>
	
	<saml2p:RequestedAuthnContext Comparison="exact">
		<saml2:AuthnContextClassRef xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://refeds.org/profile/mfa</saml2:AuthnContextClassRef>
	</saml2p:RequestedAuthnContext>
	
</saml2p:AuthnRequest>

3. 在IdP请求SSO服务 ​

备注：这里的IDP 就是（IDS7（CIAP））

用户代理在身份提供者处向SSO服务发出POST请求。

请求地址为：

http[s]://[认证地址]/authserver/idp/profile/SAML2/POST/SSO

请求参数：SAMLRequest=xml的加密串（第二步说的xml串的base64编码值）

request.png

*在IDS7（CIAP）认证登录通过后会通过http post请求返回SAMLResponse,即流程的第四步

4.用XHTML表单回应 ​

（该步骤由认证端IDS7（CIAP）发出）

示例：

req2.png

reqData.png

该SAMLResponse参数的值是以下 samlp:Response 元素的base64编码：

<?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="http://172.16.4.78:8091/sp/saml/SSO" ID="_2183413458186972019" InResponseTo="a3acdfag539jca902d69a7h3050dd54" IssueInstant="2020-05-12T05:35:53.434Z
" Version="2.0">   <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">http://ids.wisedu.com.cn:8089/authserver</saml2:Issuer>
   <saml2p:Status>
      <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
   </saml2p:Status>
   <saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_6498089878481389582" IssueInstant="2020-05-12T05:35:53.432Z" Version="2.0">
      <saml2:Issuer>http://ids.wisedu.com.cn:8089/authserver</saml2:Issuer>
      <saml2:Subject>
         <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" NameQualifier="http://172.16.4.78:8091/sp/.*" SPNameQualifier="http://172.16.4.78:8091/sp/.*">01119253</saml2:NameID>
         <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
            <saml2:SubjectConfirmationData InResponseTo="a3acdfag539jca902d69a7h3050dd54" NotOnOrAfter="2020-05-12T05:35:58.430Z" Recipient="http://172.16.4.78:8091/sp/saml/SSO"/>
         </saml2:SubjectConfirmation>
      </saml2:Subject>
      <saml2:Conditions NotBefore="2020-05-12T05:35:53.433Z" NotOnOrAfter="2020-05-12T05:35:58.433Z">
         <saml2:AudienceRestriction>
            <saml2:Audience>http://172.16.4.78:8091/sp/.*</saml2:Audience>
         </saml2:AudienceRestriction>
      </saml2:Conditions>
      <saml2:AuthnStatement AuthnInstant="2020-05-12T05:35:53.430Z" SessionIndex="_964712643732013286">
         <saml2:SubjectLocality Address="127.0.0.1"/>
         <saml2:AuthnContext>
            <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
         </saml2:AuthnContext>
      </saml2:AuthnStatement>
      <saml2:AttributeStatement>
         <saml2:Attribute FriendlyName="samlAuthenticationStatementAuthMethod" Name="samlAuthenticationStatementAuthMethod" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue>urn:oasis:names:tc:SAML:1.0:am:unspecified</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="credentialType" Name="credentialType" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue>MyRememberMeCaptchaCredential</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="isFromNewLogin" Name="isFromNewLogin" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue>false</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="authenticationDate" Name="authenticationDate" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue>2020-05-12T11:27:38.814+08:00[Asia/Shanghai]</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="authenticationMethod" Name="authenticationMethod" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue>com.wisedu.minos.config.login.MinosAuthenticationHandler</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="successfulAuthenticationHandlers" Name="successfulAuthenticationHandlers" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue>com.wisedu.minos.config.login.MinosAuthenticationHandler</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="securityEmail" Name="securityEmail" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue>hjqu19352@wisedu.com</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="longTermAuthenticationRequestTokenUsed" Name="longTermAuthenticationRequestTokenUsed" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue>false</saml2:AttributeValue>
         </saml2:Attribute>
      </saml2:AttributeStatement>
   </saml2:Assertion>
</saml2p:Response>

这里分为两种：

A、断言不加密（优先） 相反：false为不加密，那么认证端返回的SAMLResponse为base64加密的xml,解析即可拿到用户属性，xml文件内容详情见上方的 samlp:Response 代码

B、断言加密

如果需要断言加密，那么认证端返回的SAMLResponse就为加密串。配置详情见下方：

<?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="http://ids.wisedu.com.cn:8092/sp/saml/SSO" ID="_4273668766035191836" InResponseTo="ajd50ajfcb357h33e3jib9069j69cc" IssueInstant="2020-05-12T05:51:18.672Z" Version="2.0">
   <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">http://ids.wisedu.com.cn:8089/authserver</saml2:Issuer>
   <saml2p:Status>
      <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
   </saml2p:Status>
   <saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
      <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Id="_2dd3b97fee978978ae25a77cbc1c9064" Type="http://www.w3.org/2001/04/xmlenc#Element">
         <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"/>
         <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
            <ds:RetrievalMethod Type="http://www.w3.org/2001/04/xmlenc#EncryptedKey" URI="#_2ee82704067712363b343f20230177e9"/>
         </ds:KeyInfo>
         <xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
            <xenc:CipherValue>oc9IKDvXaR1zSi9we/7Rui+U7olxkT3ul54GBak/XHdO8uaqBc8CtZcLnARMATtuen2ChcxZo6ra&#13;
OKz2uFtYdyh7WRGf/0xA8Q/WUbWKMhIOwB9Uw9REWQUWvoGRnqV/YEIgCNee7lKCJ+wTpaF75AIc&#13;
IYRRxtcrPxkOrZCuF60g+Fxg8m2PYJmNBLpLIt3/Lff0CR2tdN7qHwCuarB7lqqUmyg5mP061Jr+&#13;
6CNONnEkMCTQYwW+Q8IT/OsFTEFRvAfczg5Rq0mQw2jyxtNmVn5wlv9nRbwTaMCT7D31S9rzVYAh&#13;
mg4u91gWp615gfFIcwxYgeCGUWH2+zHD2shCSQF2S6rwBly9yF2mKxKsTtTsWkiYDM/mIFIg9dVV&#13;
9L28CIS/1sPPdq+U5aN9iX9R11hah0cBMZCv6jrPW5PU5nCElhfoDvA40fYoeJyFpjwMJJpSU1M6&#13;
cegN9h/vBis40h4U9hv/99VZvoVH80dEWJIVeLgB9NvvbwhIAxIQQLww3QG+0s7yh5Y9WQeQ/1Nq&#13;
1mDRvvjWUApOVS5bxshoDGRQlI3p1X/wt3jyn6At32bMZzuQzk0EoyIRhxT44uwX2VqA6rTBD37Y&#13;
kWp6/VNf2RttaX1dTPHqqvFU1Er5MyjUSBFFDVVtOTKbkxgqnZ0fLjvvy0Vw1q+l+3btYFidJCRn&#13;
RH3v4bTZpjtT763dlMu9deUkIOwvFaxfIB9m5fY1im0V/G1v+pGZ6ErgTCuh7ks5qMMUYWcOIquB&#13;
j8N8Q5g+58YybPp7iYHgznzMThe3gIt2HcGHoJzdD5EI/WmDAWW8/tbn2WO5BmXckFT4wqhfY84z&#13;
puVad4HTR5JqSaoGmttCWbNER2bKIMQlc6tgMPcziuc6tk6EmKq7Hj7yBcJjUpWHVHkAcLAEnMSP&#13;
4ktMMZd7xhy/HVzN3qQwLioSbKjq5/3PrKFYy0wd5FcQgFetCfxEd4TPn1BVBs1eGurb5KGyc5HA&#13;
v6fv7aXMuFRpmlMm+5CwOUAlKOQJEhHiMLI/UFSQIut4Nzfdcti3oYxqB29/njbEaWw2g4+pp/0Y&#13;
f8cbOUbB1apYIq+wFsg2KuUPyCQgCbf9s9Rf3gnUXPD7j7fvVdZZHWodMHl+Y0jCqyJ8s3BDgDq4&#13;
Pr2XarWD1oxg0kpySXHEaqg7rXGoS4GvF3k3t23fA+Fr8sr3lhInGxR3IZFIDVw69XCzhYaBBOnj&#13;
4BilO7mMX0nSsJgo2tbqars47zBL3Cs6tRwiGsGotR8M9zs9v00gSjhfcZuG+PKb3LNuuMOK2r0U&#13;
P4z6Vbsaep3/IBWegvpLw+NePre24JQunDbLMkrHRFLQqEfFyjGgoAVHMHX26knoGgDB0BqozqSA&#13;
opeB5YN23g5JCrSMotiFXfUOtutYAZhKxA0t1q3pLhXDSlCdYCEX8q7qISYEeqW0ZnSSRx0w4r/e&#13;
lTblmclATttLOeynU97gZYfDlyiySJfLQk0EwtYxz4E4gyegBdl14raOyBTcMD/1/sPLomBzce70&#13;
AES/whHHU+puU7kYu+htxYRQhZ2I3TDdhXUD/D6HUNISBw9HMRDkGbagVG6kIdZRILT9wafEY0St&#13;
EsS8jhqi/asJRR1Vy558i+aj+yylsW8WDkuQyRajpmxxvxykYeNw5l/1DKiUJOe3MHQv5Q54YWfV&#13;
q3n8eFVB5tQ7G4ez+Rvu8vH1+ReYVfTrBK/GMfJZRnC6a7zW0umxwyjbxEmgo/HPYjS+dxgWrq81&#13;
AQEoTTsN+hGKGGe3RtZcNQ2yj5/8jm8SxhTY5E1cSM9CEXPgvMoecgfg8BDJfefzexsuwhItAkAv&#13;
hvdqqAFssB2YniICdNy3U5KhECF8VXPDaHQsTGsOXYxFj4PcwSZtK+TBZ0Ktz04BRLNXBr1u5xq4&#13;
tBzmIqn10g7AhM1ibxxIWat28rEGMHQO+N48eyZ6xtHJHcEZCxfoI8OKxyTD77S3JUHjE4w0dCHM&#13;
YPutRQAr8GRJB3Md+6487uXqousM2sjCq15pB7LwdiBIEUyOCpvbv1qZH+aC+UJncxk5Rectv2rT&#13;
eQLG5fKeZU5WczhWZnQoC7+LfBnVpQC2fV/7arycUlIsrzrevRfcJRiK1ECvW89RN7w4NImXpnBE&#13;
RnZYtlkBLhKMsAqMnIuyz5Rliz5z/y34K0YLbt5MUNgFfgb4DRrCslaV0SuYMZguREcumNdh0fR3&#13;
5C/z2Ue++b/bdxzRUe+YBuJG62HFvWLo/0C+SRDQDCoD8gFB/+/ZLzBQlHrmIPqEEHRDPsP7lShW&#13;
3ZXa/Xq131gM/UrFtTHeAAZmug+o9DHIEudOuCvu80aLope4ZtFMo/IUKXiE3AK6G0MYC6r1hbSf&#13;
iyDbMbJpPoqsW4dI6Cx/Mgvx+mrJFc3bz7SUWXQZw5l6jpJqMEpqzKqgjs+aXXcPNcBytB/4+rjf&#13;
usTTeDcW8r0NC5Wo3vVtASRj/OhKi4laAihHKAb8LYYYfsEpsgUfqWYFehD+yqUP5wIbmRuZGMP5&#13;
AE4l5n23rCDcp99Z8C26GSYpNnWnj0Lmq2hiskLDwycREYd/RK+PpZVqn83k9ZVXWINR0DZvK+Vs&#13;
rLIQjBBdSaL/5Ydy1C4KgYC+iCayPQ59qwm1Ui8Ie/ybynvJPnXfCDym7uXFsWgjKFXRIxPouPU0&#13;
65YMgQtVCfbAIs7Rxuoo02Fsc2s48NkGglk2GK6pWuDAnn7cVDcAMCRw9exRpcM6bHdbNFdRw9Nl&#13;
cN5QTgi0FvefILcdHOtkhODB8DiVGjiQXjrFwGpqf3Dl71UieSYonM56T2zk99j1dSYyetkZd0Eb&#13;
TFtk3P01lvR/ATxxgQMYjlfgz95sRzbJiMqhxsx1I2iIf/6YoWiIvNnlnFcsx3vtd0Lak+OTZ4yd&#13;
gqWVCwdXzKyZ0mPUvKGNG03TkggSCPFFTkyeYXv2fFkhrcRYYn+7VOuMS3E/RVWuyAQUBKpzdfKD&#13;
Cg2a1fh+jBXzIwN5e24CjY7DuyXShAwktTLUmWmuLErp3vFnZUI4kBW+ENcaaBMJeL6JtQYuDNU5&#13;
pjfkPszrnbAHBxwGSwbgL8tAbAp1PoBZ/tlc4diqmvuN+e2H/ujQyjPfYFtOUnjFMOK5J7hByUhb&#13;
8eeI0KNDxPd527i75PeSmeqO9Qqcp43K3rw6qiVBWAM8YVkdLZVMmjvxRiTK/QbjGhKauIBTg7EK&#13;
SGWsH1p3stj4UzXzZ72QgZbh0wd2jCskhV8MiyWBls7Dw/Vdqtcm4utZ59GM8YrnsOOEaIG8gcYc&#13;
cYLFHAMwxtUCD37LHo1cmnWGoqEbbbQvRhnirSyg8qfnu4AOxOxqJJOyVpgV2lz/lKDkHYeLHYPJ&#13;
tF1yHdV0E0yI4BLIFtBJo7/y1vO+aBK+dEp2YZwXjb7kq6ciApzXXEkbNp9uEixt6jY2aCX8N9kA&#13;
UoLIy6rS01ybEeokWyQVXi3hogl6flSzE4mLpaSVjL+znQm0cXkl+1o0pn3+QK23E3PNmd6dgJEf&#13;
6bg+CWtm0uiEJZVkdWmjK107K8CCRfHiQi9bi3CMFuhafBnfKloyL4yjiXIS9k1rkVqdCqAmGxYl&#13;
heTu7ieVDgtDgOm38VVvA6ozfG78rUSDH4UI49zbg2kCv2GzQuj0FvdmITqekF3JVp2aVwnkPYfc&#13;
B3ld4I9tzTp8Laz79bnJnIuFnbTq2yxh3WF4unTDaSl7J6VZWN7xT4jZiSYHEfejbcpIq0tOBB3h&#13;
Kh+CrF6nzvtxmO2kUJvma/H157IjbKWe4bp2+54tXfjQrDLb8wcgz8KFtTwOi71Ttg3KhRKjTMZV&#13;
0bl6f/gnBqimS2evt9jqfYrnooY777JKD3euGinR6qqqbjyNowM8dVvGoV+45KJGGM4bNXUUH/wQ&#13;
RqjZM9yGSONr/47yKaat4yDNWPdePjNFW9DV9mRsuXhP21KZT0Sgifs7KX4yKrAiBPmb2pratL2O&#13;
IpfuNMbPqM5dF2K8Ar/eHYTZmo8ISer6sPO3Qx8GS/88AzsQ1d4wI603VjblT62GvZOLDAxfzpjh&#13;
/f648IC2Ib05Wy61xPFSskLgNKzyPmjFRyCMCnFbH0e3+WcOMQwt+w7L5IRkwvprFfNtRnv7IQU7&#13;
07tF8/4qQ8bKLTeQJugXyRFB+xxe822IdI5NwAh0VA7sZANAH8mR6PP3M820UT9+QcAqdycAb5by&#13;
KVVpW+eIPHeCj5OychK2Cm8kE41i3pNE7m3iwEKqpE7hkjMREanKgQUJgVppvAAmqeJOEwaVWur/&#13;
yM7j7D7+Fqv4T5aRfAM2GJztFTQZ9SehJe1Lj7lyH5gUU1pjrPB3oZTASU+953CjqxabKImVg7Ts&#13;
lJzQiysBgy0kYhnFsbmCrd+f+xSlTMVH0qSu22rTa4iy8eM0nBnIw9ygkwnD9LsZsLMogTvHTFcx&#13;
r4IjIn3TUiu8KL/jmJhJPy+4KvEYr3JQZQ5XX5OTiyoN77/zcKR1NsB621tIvJyZHKcmPIyul5RB&#13;
loQX/5IA2ozrvZDJ8RSethHiMSBX32M32Bar216pBDQgfP7OEs+SE4dnQgtIVWvX/Kv6NqG7/QJN&#13;
C8MK3CjxMWvcPdhvMWdMlNq8FKXARvbBWwM+sMJk2Yco0L2+ZwWFQoTTxEaNpHxEArZLaZfvaQG9&#13;
iRQR5syNg5fS/Spuq6LRP3RPCJErjYeoh39mnWzG/IFcTHUS79Efz37K4tx80rsOoY8qzCGxacvc&#13;
VC9lfJS1/Ccg6znju5jWs0x3LQAMmcuwSVtOn09GwH+jUDs2z5i6b8NN3WcObHwIh2RnTU2dug/R&#13;
UZaXe8dX3o8itea0eozhKKi6AxZYKCGc9TG5EXVGY1WzrLj8dLI11v4w2rTrOlSk6d8tVOFZ8gwv&#13;
Zc6EMTHKS15szPaK/8/pSSoTi3mRdaHJh0PdMSi//HO3ujLzSxyp8Y+1n6s3sAEh/GNowiOozxxc&#13;
AGEdHBwmS9sHJ+UReDduawfD+3+/gu368h+YdpsCTUCYk+lmhd4qxu9fmKUcUF00L3Yar4Btzp9b&#13;
Doi8yrzNFmtbyvGqwyk=</xenc:CipherValue>
         </xenc:CipherData>
      </xenc:EncryptedData>
      <xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Id="_2ee82704067712363b343f20230177e9" Recipient="http://ids.wisedu.com.cn:8092/sp/.*">
         <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
            <ds:DigestMethod xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
         </xenc:EncryptionMethod>
         <xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
            <xenc:CipherValue>cQUGWMSipkjrnD3IKY8GwD/CMKO4gr7r+KeTBEYf7gfi4S7tHBQmQ+pvOgw+qR8M1HrW2KITd6o1&#13;
GVA3Wzm6I+TZTXNQ2t+Ntv2oI9CvaDDFGpux3LXScirJnvL6ZHz401l6aUt+kdeFPv1zThAle3j5&#13;
5+meLp4GBwgmC85YWczRVGaeEW967IunvhtYISpftsNGTelDHuDLM/I7jstcrUfrk0gQBC1aLzeE&#13;
vSv6c5vGykx+7EH3ZOxMl0AxVFbTOyx6ju5FfFbWPR5jR3+hskEGJ6hf3Ou0CLd6bEsE8et6NCRK&#13;
GL2T9wPyUcDeFbMNcb43Sm0ygEJb276HEIO7QA==</xenc:CipherValue>
         </xenc:CipherData>
         <xenc:ReferenceList>
            <xenc:DataReference URI="#_2dd3b97fee978978ae25a77cbc1c9064"/>
         </xenc:ReferenceList>
      </xenc:EncryptedKey>
   </saml2:EncryptedAssertion>
</saml2p:Response>

5. 向SP请求断言消费者服务 ​

Request URL:

http[s]://[认证地址]/sp/saml/SSO

（该地址由客户端自己定义，但是需要能解析由认证端通过http post请求返回的SAMLResponse，该SAMLResponse中有认证端返回的用户信息等）

请求参数：SAMLResponse（base64 加密串）

6. 重定向到目标资源 ​

断言使用者服务处理响应，在服务提供者处创建安全上下文，并将用户代理重定向到目标资源。

7. 再次向SP请求目标资源 ​

用户代理再次向服务提供商请求目标资源：

 https://sp.example.com/myresource

8. 用请求的资源回应 ​

由于存在安全上下文，因此服务提供者会将资源返回给用户代理。

9. 单点登出 ​

xmlData.png

管控台配置 ​

添加应用 ​

step3.png

step4.png

配置saml协议 ​

step5.png

step6.png

启用协议并获取appId和AppSecret ​

step7.png

wmaConfig.png

江苏金智教育信息股份有限公司

Copyright © Jiangsu Wisedu System Co.,Ltd. All Rights Reserved. 2025 版权所有