Security Assertion Markup Language (SAML2.0)

最新推荐文章于 2021-04-26 21:46:58 发布
最新推荐文章于 2021-04-26 21:46:58 发布
阅读量1k 收藏
点赞数 1
文章标签： security protocols algorithm authentication soap reference

Introduction

SAML is XML based framework used by business entities or partner , to share the authentication , Attribute , entitlement informations about an entity . An entity can be termed as end user who has some business dealing with these business partners or it can be business partner , or application also.

Background

TO get the technical overview of the SAML just go through the link

http://www.oasis-open.org/committees/download.php/20645/sstc-saml-tech-overview-2%200-draft-10.pdf

Overview

SAML can be used in the following three scenarios

1.Single Sign On(SSO) : SAML is specially used to solve the multidomain problem. For example user has account with example1.com and example2.com, where these two are business partners. with single sign on facility , user has to login just one time on website and he will be able to access resources from both the websites . sharing authentication infomation is fairly simple as SAML provides independant grammer and protocol to share information from one server domain to other domain

2.Federated Identity: As maintaining identity information for each of the services that a user is subscribed to tedious process . SAML solves this problem by providing grammer to establish a identity known as federated identity. This is shared name identifier used to refer to a end user or an entity who is using the services offered by various partners.

3.Web Service Security: SAML also provides facility to secure the web services. This is done by using saml assertion in the soap header to to transmit the information which is not possible using other security formats.

Read about SAML Protocols and Assertions

http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf

Using the code

Before you start any programming on SAML , all you need is set of protocols and assertions which you can use for any of the scenario discussed above. I have been using SAML2.0 for generating federated Identity.

To generate the assertions and protocols , all you need schema definitions to generate the code. you can get SAML2.0 schemas from the link below

http://docs.oasis-open.org/security/saml/v2.0/

Use Xsd.exe provided in the visual studio to generated the code .An example is as given below.

// C#
//   xsd SAMLSchema.xsd /language:CS 
//

Note that you need to provide all dependant schemas in order to generate full set of SAML protocols and assertions classes. These classes are serializable to XML

Binding the SAML Assertions and protocols : One important issue with these assertions and protocols used in SAML is on the wire they should represented as it is. SAML binding defines how saml assertions and protocols can be embeded in standard communication protocols , Go through the link below

http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf

Test case scenario : The entity which provided federated Identity for the a user , is called Asserting party , which makes assertions also called as SAML authority . THe entity which consumes these assertions is called as Relying party. Here Example1.com want to generate a federated identity for the user(with consent of the user) with Example2.com. So Example1.com generated a SAMLAuthentication request and sends it to Example2.com to generate a external identity. Example2.com generated SAMLAuthentication response and sends it to Example1.com. THis response contains a Assertions from which a NameIdentifier is Can be retrieved.I am using HTTphandlers on both sides to handle this scenario. Using HTTPPost to send a request and receive a response on the wire.

The saml authentication Request inside a soap envelope:

Collapse 
 <env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/">
  <SOAP:Body xmlns:SOAP="http://schemas.xmlsoap.org/soap/envelope/">
 <samlp:AuthnRequest xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
 ID="RlFme3cd9ThZVDg6a8Yqjg" Version="2.0" IssueInstant="2007-04-04T22:50:32.0860086Z" 
Destination="http:://www.Example2.com" ForceAuthn="false" IsPassive="false" 
AssertionConsumerServiceURL="http://www.Example1.com" 
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
  <saml:Issuer>http://www.Example1.com</saml:Issuer> 
  <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistant" AllowCreate="true" /> 
  <saml:Conditions NotBefore="2007-04-04T22:40:32.0860086Z" NotOnOrAfter="2007-04-04T23:00:32.0860086Z" /> 
 <samlp:RequestedAuthnContext Comparison="minimum">
  <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:X509</saml:AuthnContextClassRef> 
  </samlp:RequestedAuthnContext>
 <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
 <SignedInfo>
  <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> 
  <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /> 
 <Reference URI="#RlFme3cd9ThZVDg6a8Yqjg">
<Transforms>
  <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> 
  <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> 
  </Transforms>
  <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> 
  <DigestValue>7rLUhKYbusvESNYjbimJLUrvkXM=</DigestValue> 
  </Reference>
  </SignedInfo>
  <SignatureValue>FDG7OPfFDA/MpF3jWTQfhKvsGaopt0W
/pXf0t81ehZDvJ8VYtgvSaSOtD1Mhxt8x/7O8VE4GHBaA4q
/VKbRKYj9F2lEUGi13Gt3iHOXHLYF6Sa5wa1Rrav2RNd
05VUlGunghhxrUNScID+Ks5hVPgWU8bCj7O5EGg84PNlbAZoA=</SignatureValue> 
  </Signature>
  </samlp:AuthnRequest>
  </SOAP:Body>
  </env:Envelope>

SAML Authentication Response in Soap Enevelope:

Collapse 
 <soapenv:Body xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
 <samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xmlns:xsd="http://www.w3.org/2001/XMLSchema" ID="_od8zwzNH4shfrUGeewHng" 
InResponseTo="RlFme3cd9ThZVDg6a8Yqjg" Version="2.0" 
IssueInstant="2007-04-04T22:51:52.4172846Z" 
Destination="http://www.Example1.com" 
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
  <saml:Issuer>http://www.Example2.com</saml:Issuer> 
 <samlp:Status>
  <samlp:StatusCode Value="Success" /> 
  <samlp:StatusMessage>Valid User</samlp:StatusMessage> 
  </samlp:Status>
 <saml:Assertion Version="2.0" ID="1DNDh3_IC7KkVwbffd07Jw" IssueInstant="2007-04-04T22:51:52.4172846Z">
  <saml:Issuer>http://www.Example2.com</saml:Issuer> 
 <saml:Subject>
  <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistant">
e9da6e5a-81dd-4c31-a7d9-6b4107b5f443</saml:NameID> 
  <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer" /> 
  </saml:Subject>
 <saml:Conditions NotBefore="2007-04-04T22:49:52.4172846Z" NotOnOrAfter="2007-04-04T23:01:52.4172846Z">
 <saml:AudienceRestriction>
  <saml:Audience>http://www.Example1.com</saml:Audience> 
  </saml:AudienceRestriction>
  </saml:Conditions>
 <saml:AuthnStatement AuthnInstant="2007-04-04T22:51:52.4485176Z"
 SessionIndex="18ABA929-A685-4935-8D4D-40D3FA26FE3F">
 <saml:AuthnContext>
  <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:X509</saml:AuthnContextClassRef> 
  </saml:AuthnContext>
  </saml:AuthnStatement>
 <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
 <SignedInfo>
  <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> 
  <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /> 
 <Reference URI="#1DNDh3_IC7KkVwbffd07Jw">
 <Transforms>
  <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> 
  <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> 
  </Transforms>
  <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> 
  <DigestValue>WnPo9ySpwd5iCyaXpRuBwr8Qjx0=</DigestValue> 
  </Reference>
  </SignedInfo>
  <SignatureValue>PYTA7kIWP3stDIiRY+
d5dWUAehwbbThYg+U9woqE61ZNFr/kJzJZTh3m+0MOM3fAnU9ILYsNc
SNhEueXOTSek9yA3nIuYHyowb75hVHI0oR1Kp9DHvWsoLE4U36d6FANNOIAi3BQUe
84vLevfT0gpwnz8nXvttUgO7RnamGRBOI=</SignatureValue> 
  </Signature>
  </saml:Assertion>
  </samlp:Response>
  </soapenv:Body>

Hope this will help in getting good understanding of SAML language for all who are interested in SAML

 
arrio
关注
SAML2.0 简介
03-23
安全断言标记语言（Security Assertion Markup Language, SAML）是一种用于交换认证与授权数据的标准协议，特别是适用于跨域单点登录（Single Sign-On, SSO）场景。SAML 2.0 是该标准的一个版本，它基于 XML，并使用...
深入浅出SAML协议
热门推荐
日薪灬越亿的博客
03-15 1万+
SAML概述 SAML（Security Assertion Markup Language 安全断言标记语言）是一个基于XML的开源标准数据格式，为在安全域间交换身份认证和授权数据，尤其是在IDP（Identity Provider身份提供方）和SP（Service Provider 服务提供方）之间。SAML是OASIS（Organization for the Advancement of Structured Information Standards 安全服务技术委员会）制定的标准，始于2001
Security Assertion Markup Language (SAML)
arrio的专栏
05-31 1万+
Contents Overview Publication Highlights Principal References Related Activity News, Specifications, Articles, CommentaryOverview"SAML, developed by the Security Ser
基于SAML的单点登录介绍
weixin_34198453的博客
11-19 1688
一、背景知识： SAML即安全断言标记语言，英文全称是Security Assertion Markup Language。它是一个基于XML的标准，用于在不同的安全域(security domain)之间交换认证和授权数据。在SAML标准定义了身份提供者(identity provider)和服务提供者(service provider)，这两者构成了前面所说的不同的安全域。 SA...
我眼中的SAML (Security Assertion Markup Language)
weixin_30546189的博客
12-08 958
提到SAML (Security Assertion Markup Language), 很多人都会联想到单点登录SSO。那么Saml到底是什么，它跟sso到底有什么联系？这里给大家分享一下我在读完了saml差不多全部规范之后的一些心得。希望给saml入门者一些帮助。我并不想详细介绍每个xml节点怎么写。大家可以参考标准规范。 看了这篇随笔，相信如果万一哪天你要做saml， 你也不会害怕了。 ...
SAML2.0协议 - 维基百科版翻译
如果你真的想做一件事，你一定会找到方法； 如果你不想做一件事，你一定会找到借口。
10-26 3098
[url=http://saml.xml.org/saml-specifications]SAML 2.0 Specifications - http://saml.xml.org[/url] Security Assertion Markup Language(SAML)是以XML为基础的，为在安全域间交换认证和授权数据的标准，即在[color=red]身份提供者（断言的产生者）和服务提供...
SAML2.0核心协议规范saml-core-2.0-os
02-14
SAML 2.0（Security Assertion Markup Language 2.0）是一种开放标准，用于在不同的安全域（通常是企业和服务提供商）之间交换身份验证和授权数据。这一规范被广泛应用于网络身份管理，特别是在单点登录（Single ...
SAML2.0的纯英文文档
08-01
SAML（Security Assertion Markup Language）2.0是一种标准的协议，用于在不同的安全域之间交换身份验证和授权信息。这个标准被广泛应用于单点登录（Single Sign-On, SSO）场景，使得用户只需要一次登录就能访问多个...
office 365 SAML2.0示例
04-23
为了提高用户体验和安全性，Office 365 支持多种身份验证协议，其中SAML 2.0（Security Assertion Markup Language 2.0）是一种广泛使用的标准，它允许用户通过一个身份提供商（Identity Provider, IdP）进行单一...
SAML v2.0 开发指南 SSO必备
08-18
本书详细讲解了基于SAML进行开发单点登录技术的详细细节。是单点登录技术的必备资源。
SAML2.0简要介绍
08-04
SAML(Security Assertion Markup Language) 安全断言标记语言 标识化组织OASIS提出的用于安全互操作的标准 版本：1.0，1.1，2.0 主要内容 SAML断言：定义交互的数据格式 SAML协议：定义交互的消息格式 SAML绑定(binding):定义如何与常见的通信协议绑定 SAML使用框架(profile)：给出对SAML断言及协议如何使用的建议
基于SAML 2.0 SSO单点登录
01-23
基于SAML 2.0 SSO单点登录，包括VS2005，VS2008，VS2010。有部分Java代码。含文档。 client发送saml请求---sso响应验证client是否可信任---可信响应saml----加密saml---发送到client---client解密成功--验证信息是否有效----有效----登录成功
【安全断言标记语言之SAML介绍】
06-18 387
Security Assertion Markup Language 2.0 (SAML 2.0) is a version of the SAML standard for exchanging authentication and authorization data between security domains. SAML 2.0 is an XML-based protocol th...
sam-tach-overview
sunshinebo的博客
04-26 661
Security Assertion Markup Language (SAML) V2.0 Technical Overview Committee Draft 02 25 March 2008 Specification URIs: This Version: http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0-cd-02.html http://docs.oasis-open.org/security
SAML(Security assertion markUp language) 安全断言标记语言
weixin_34252090的博客
01-04 294
去看spring框架提供的demo哦！　　 转载于:https://www.cnblogs.com/njqa/p/8191858.html
安全声明标记语言SAML2.0初探
程序那些事
12-13 1万+
SAML的全称是Security Assertion Markup Language， 是由OASIS制定的一套基于XML格式的开放标准，用在身份提供者（IdP）和服务提供者 (SP)之间交换身份验证和授权数据。 SAML的一个非常重要的应用就是基于Web的单点登录（SSO）。 接下来我们一起来看看SAML是怎么工作的。
SAML2.0核心协议规范saml-core-2.0-os详解
SAML2.0核心协议规范（saml-core-2.0-os）是OASIS（Organization for the Advancement of Structured Information Standards）于2005年3月15日发布的标准文档，全称为Security Assertion Markup Language (SAML) V...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值