amazon-cognito - 为什么 Cognito 拒绝我的 SAML 断言？

问题描述

我正在做一个将 SAML 联合到 Cognito 的概念验证。我已经设置了 Shibboleth v3，一旦我最终设置了日志级别，我可以看到 SAML 被发送回 Cognito，它只是重定向到我?error_description=Error+in+SAML+response+processing%3A+Invalid+SAML+metadata.+&error=server_error在 URL 中配置的页面。Cognito 中的用户池设置为需要一个电子邮件地址，我认为我已经正确设置了属性映射，但这并不容易分辨。这是我在日志中看到的 SAML（为了匿名，减去几个 URL）：

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response
    Destination="https://{DOMAIN}.auth.us-east-1.amazoncognito.com/saml2/idpresponse"
    ID="_cc28aebe7ae433f549a7df77e8a2fbaa"
    InResponseTo="_d34b0821-c6eb-408d-b687-5fb2b71422dd"
    IssueInstant="2019-06-10T18:00:23.314Z" Version="2.0"
    xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://idp1.example.com:8443/idp/shibboleth
  </saml2:Issuer>
  <ds:Signature
      xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:SignedInfo>
      <ds:CanonicalizationMethod
          Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
      <ds:SignatureMethod
          Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
      <ds:Reference
          URI="#_cc28aebe7ae433f549a7df77e8a2fbaa">
    <ds:Transforms>
      <ds:Transform
              Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
      <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
            <ec:InclusiveNamespaces PrefixList="xsd" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>
          </ds:Transform>
    </ds:Transforms>
    <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
    <ds:DigestValue>3wL9vw0MsEuSGO+0bir/6GQV1FVNQHw4fLgAXteHQK0=</ds:DigestValue>
      </ds:Reference>
    </ds:SignedInfo>
    <ds:SignatureValue>
      LvCSLdm87hWsK480jhv/8JXBciPmGmAeUVxkGpAKUal5omnmpASXflSBHutkRwyPzD6mXMgSk3xL
      f0IfWwspbA3ixmbbeEwQciel+2Y4WxwPpWreV1aLHMLYSj8x8ZdiDSioczMwRpQSqVo6RCX98ayo
      riTBwTaoIQTHcE6xdDb98zDVCL+tCvrgkT3fhl0Z9HBxDvdy/YyrEuv0QVTj9SHiTI6heY5AhvA8
      3qCAaGdbsNc0jqvy6AUAp1VBy8QJGpWMvChXJnO8srUEKkVBhGRfScCaO2uDcpa90zAlSuD1B7Q7
      vVVrahRCB2lJHEmAyM2XeNNwN+DbyFU2Lcz4Kg==
    </ds:SignatureValue>
    <ds:KeyInfo>
      <ds:X509Data>
        <ds:X509Certificate>MIIDVDCCAjygAwIBAgIUIBWSFzIstjdAx2yVXLC40xKOIYAwDQYJKoZIhvcNAQELBQAwJzElMCMG
    A1UEAwwcaXAtMTAtMjAzLTEwLTkxLmVjMi5pbnRlcm5hbDAeFw0xOTA2MDQyMTU1MDhaFw0zOTA2
    MDQyMTU1MDhaMCcxJTAjBgNVBAMMHGlwLTEwLTIwMy0xMC05MS5lYzIuaW50ZXJuYWwwggEiMA0G
    CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCaaLJ5lqB8eWuIiKPhDVsxOBncTnVS7wjjQOJ6pkSJ
    El8G1MnMIb5xaQBv9luwq88+EcmWIZDzt4Yj326tmz4lwweWa4VI3iVfk6eZl7Zpwlcj57dtvA8B
    MhcmbqX56Kb3pmTLf4VAI8hPoHdmKNYFapy+uM4b6ubvLx1NxlzgWfZ3o0ZrTuOpNpFgXJB+FGMS
    au4lOCvOVchU7ymch2qwP/iFSUnNcviL9k/M4tSIkbf+Tb9o9SQrJhwcBMdQDfsLKnDhEtvovX12
    H70smzVCg/H3AVUE+Qne5Cget90xKKRtQcSV2Q4jIS0mRGc5XVEQEiVzOLvx6DyLXUs926JxAgMB
    AAGjeDB2MB0GA1UdDgQWBBT0+FXPDXOe+gtZsNA+dnzPvJysWzBVBgNVHREETjBMghxpcC0xMC0y
    MDMtMTAtOTEuZWMyLmludGVybmFshixodHRwczovL2lkcDEuZXhhbXBsZS5jb206ODQ0My9pZHAv
    c2hpYmJvbGV0aDANBgkqhkiG9w0BAQsFAAOCAQEAaM1kS0CoKBy4l1wRihbvsfX78FCmKk4woWEk
    a0st/c42ntf7nU8b/4C6SV9Jl7rhij18um6tF6dv+pVsH5KrDQbdH3xwF24ekDqosEaHSxcmY79k
    1TePd00xH8/udeKRFc+78LnkygnzulZZ748XKj9/ehUkfbrhWhGP3333Nruj5Ptlv7d4upCxtQ+g
    dYmHIzFt26MHR5jxcwYWPd/4M1ElakevscWOBjKTpScOnMYOikzyZpS+p7hD5/z4OfKv6AWLPdek
    eWVXGlZhRKhtp15tRrUpQucZFMh+YNOm9IlBRBeh5Qw4KQgg1KvkNy1+iA9vfptn+f2CtPhF+cxx
    3Q==
    </ds:X509Certificate>
      </ds:X509Data>
    </ds:KeyInfo>
  </ds:Signature>
  <saml2p:Status>
    <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
  </saml2p:Status>
  <saml2:Assertion ID="_4df74e3ced3d853e5a0c329e0f7c83cb"
           IssueInstant="2019-06-10T18:00:23.314Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
    <saml2:Issuer>https://idp1.example.com:8443/idp/shibboleth</saml2:Issuer>
    <saml2:Subject>
      <saml2:NameID
          Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
          NameQualifier="https://idp1.example.com:8443/idp/shibboleth" SPNameQualifier="urn:amazon:cognito:sp:us-east-1_MyLIE83bf">AAdzZWNyZXQxrczu0aLzz4zQafYgy5VN8rTutrL827I6iPTAGPVAGJlJKAcQIHAdkWP1uqtsYqAccnsy0GPpTNx8GgTudWw6Q5ovEh/zSlYq+A/eExrAuT5sJlatEGua7boJDq63t1fESo4qOmz3uW+Pbik=
      </saml2:NameID>
      <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
        <saml2:SubjectConfirmationData Address="10.203.10.25"
                       InResponseTo="_d34b0821-c6eb-408d-b687-5fb2b71422dd"
                       NotOnOrAfter="2019-06-10T18:05:23.730Z" Recipient="https://{DOMAIN}.auth.us-east-1.amazoncognito.com/saml2/idpresponse"/>
      </saml2:SubjectConfirmation>
    </saml2:Subject>
    <saml2:Conditions NotBefore="2019-06-10T18:00:23.314Z" NotOnOrAfter="2019-06-10T18:05:23.314Z">
      <saml2:AudienceRestriction>
        <saml2:Audience>urn:amazon:cognito:sp:us-east-1_MyLIE83bf</saml2:Audience>
      </saml2:AudienceRestriction>
    </saml2:Conditions>
    <saml2:AuthnStatement AuthnInstant="2019-06-10T18:00:12.508Z" SessionIndex="_c1e143fa5c01b3642d1ce4573bfe9465">
      <saml2:SubjectLocality Address="10.203.10.25"/>
      <saml2:AuthnContext>
        <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
      </saml2:AuthnContext>
    </saml2:AuthnStatement>
    <saml2:AttributeStatement>
      <saml2:Attribute FriendlyName="mail" Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue>bob@example.com</saml2:AttributeValue>
      </saml2:Attribute>
      <saml2:Attribute FriendlyName="Role" Name="https://aws.amazon.com/SAML/Attributes/Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">arn:aws:iam::{ACCOUNT}:role/FederationWorkshop-ReadOnly,arn:aws:iam::{ACCOUNT}:saml-provider/idp1   </saml2:AttributeValue>
      </saml2:Attribute>
      <saml2:Attribute FriendlyName="RoleSessionName" Name="https://aws.amazon.com/SAML/Attributes/RoleSessionName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml2:AttributeValue
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">bob</saml2:AttributeValue>
      </saml2:Attribute>
    </saml2:AttributeStatement>
  </saml2:Assertion>
</saml2p:Response>

有没有我遗漏的一些简单的东西（目前 SAML 和 SSO 的复杂性绝对不是我的驾驶室）。

标签： amazon-cognitosamlshibboleth

解决方案

问题：“为什么 Cognito 拒绝我的 SAML 断言？”

快速响应：
此问题的三个潜在根本原因：

(1) 您的 SAML 断言不携带/提供 Cognito 所需的所有属性（请参阅下面的详细答案和解决方案）。

(2) 属性不符合 Cognito 要求的格式。

例如，（请注意，请将“ACCOUNT_NUMBER”替换为您由 Amazon AWS 分配的 aws id（例如 123456789012））

attribute #1: awsRoles
attribute #1 value: arn:aws:iam::ACCOUNT_NUMBER:role/shibbolethidp,arn:aws:iam::ACCOUNT_NUMBER:saml-provider/Shibboleth-IdP
attribute #2: awsRoleSessionName
attribute #2 value: winston.hong@example.com

(3) 属性值未通过 Amazon AWS 的 ADMIN 控制台在 Cognito 上注册（参见后面的(II)关于角色的重要说明）。

备注
(1)向用户池添加 SAML 身份提供者表明用户池（非身份池）的受众 URI/SP 实体 ID 为 urn:amazon:cognito:sp:your-User-Pool-ID。

(2) How to enable security access to Kibana using AWS Single Sign-On介绍了如何利用 AWS SSO 访问 Kibana（Amazon Elasticsearch Service，AWS 内部服务）。

下面提供了用户池（非身份池）的两个重要 SAML SP 参数的示例。

(I) Application ACS URL: https://<Elasticsearch domain name>.auth.<AWS region>.amazoncognito.com/saml2/idpresponse

(II) Application SAML audience: urn:amazon:cognito:sp:<user pool id>

问题：“Cognito 中的用户池设置为需要电子邮件地址，我认为我已经正确设置了属性映射，但这并不容易分辨。”

答：
您的 SAML 响应表明您的属性映射设置不正确。

(1) Cognito 不需要您的 Shibboleth IdP v3 SAML 响应携带的属性“RoleSessionName”对 Cognito。

<saml2:Attribute FriendlyName="RoleSessionName" Name="https://aws.amazon.com/SAML/Attributes/RoleSessionName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">bob</saml2:AttributeValue>
</saml2:Attribute>

Shibboleth IdP v3 SAML 响应 Cognito 携带的正确属性“RoleSessionName”应该是您的电子邮件地址“bob@example.com”，而不是您的名字“bob”。

<saml2:Attribute FriendlyName="RoleSessionName" Name="https://aws.amazon.com/SAML/Attributes/RoleSessionName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">bob@example.com</saml2:AttributeValue> </saml2:Attribute>

(2) 分辨率：（根据您的数据存储库，例如 LDAP，可能需要进行小修改）

添加属性解析

    <resolver:AttributeDefinition id="awsRoles" xsi:type="ad:Simple" sourceAttributeID="employeeType">
        <resolver:Dependency ref="myLDAP"/>
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="https://aws.amazon.com/SAML/Attributes/Role" 
    friendlyName="Role" />
    </resolver:AttributeDefinition> 

    <resolver:AttributeDefinition id="awsRoleSessionName" xsi:type="ad:Simple" sourceAttributeID="mail">
        <resolver:Dependency ref="myLDAP"/>
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="https://aws.amazon.com/SAML/Attributes/RoleSessionName" 
    friendlyName="RoleSessionName" />
    </resolver:AttributeDefinition>

进入“attribute-resolver-full.xml”或“attribute-resolver.xml”（取决于您的 Shibboleth IdP 配置）。Shibboleth IdP 属性解析器示例。

请注意，OpenLDAP 属性“employeeType”用于承载 Amazon AWS 的角色。您的数据存储/存储库可能使用不同的属性来承担亚马逊 AWS 的角色。

(I) 以下 OpenLDAP 属性已通过 AWS 管理控制台映射到 AWS 配置。

mail: winston.hong@example.com
employeeType: arn:aws:iam::ACCOUNT_NUMBER:role/shibbolethidp,arn:aws:iam::ACCOUNT_NUMBER:saml-provider/Shibboleth-IdP

（二）我们提供了使用Google G Suite配置Amazon AWS的官方链接，描述SAML IdP配置步骤（通过AWS管理控制台执行）：

Cognito 为 SAML 提供者配置身份池指出

Before configuring your identity pool to support a SAML provider, you must first configure the SAML identity provider in the IAM console. For more information, see Integrating third-party SAML solution providers with AWS in the IAM User Guide.

将第三方 SAML 解决方案提供商与 AWS 集成表明

Amazon Web Services cloud application – This article on the Google G Suite Administrator Help site describes how to configure G Suite as a SAML 2.0 IdP with AWS as the service provider.

访问 Google G Suite Amazon Web Services 云应用的链接，然后点击“Step 1: Set up Amazon Web Services as a SAML 2.0 service provider (SP)”，您可以得到以下 Amazon AWS for Cognito 的 SAML 配置步骤。

4. log in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
5. In the navigation pane, select identity providers and then click Create SAML Provider.
6. Select SAML as the Provider Type, and give it a name such as GoogleApps.
7. Upload the IDP metadata you saved earlier from the Google Admin console SAML settings.
8. Click Next Step and on the following page, click Create.
9. Click the Roles tab on the left sidebar and click Create a New Role to create a role which will define the permissions.
10. Select Set role name. This name will be displayed next to the login name on the AWS console.
11. Select Role for Identity Provider Access.
12. Select Grant Web Single Sign-On (WebSSO) access to SAML providers. Click Next Step.
13. Leave the Establish trust settings as they are. Click Next Step.
14. Use the Attach policy settings to define the policies your Federated Users will have. Click Next Step.
15. On the following page, review your settings, then click Create the Role.
16. Select your Google service from the identity providers list and note the Provider ARN. This contains your AWS Account ID and the name of the provider (example: arn:aws:iam::ACCOUNT_NUMBER:saml-provider/GoogleApps). 
17. Click Save to save the Federated Web single sign-on configuration details.

关于角色的重要说明
(a) OpenLDAP 属性“employeeType”在我使用 AWS 控制台的验证实验中是角色。

(b) 确保 OpenLDAP 属性“employeeType”与您的 AWS 配置设置“角色”映射**

(d)设置角色名称 （例如 shibbolethidp 或 googleapps，AWS 会将其转换为 arn:aws:iam::ACCOUNT_NUMBER:role/shibbolethidp 或 arn:aws:iam::ACCOUNT_NUMBER:role/googleapps）

(III) 为了您的方便，我已经做出了第 9 次提交，将 Amazon AWS SP 元数据和相应的 SAML 配置上传到How to build and run Shibboleth SAML IdP and SP using Docker container。
请注意，我已经使用运行 Docker Container 的 Shibboleth IdP和第 9 次提交成功地使用用户名“winston.hong@example.com”登录到 Amazon AWS 账户（“ACCOUNT_NUMBER”，例如 123456789012）。

通过参考如何使用 Docker 容器构建和运行 Shibboleth SAML IdP 和 SP 的第 9 次提交执行 Shibboleth SAML IdP 配置，您可以使用您的用户名（“ACCOUNT_NUMBER”，例如 123456789012）登录到您的 Amazon AWS 账户（例如“winston.hong@your-company.com”）由 Shibboleth IdP 联合。

(IV) 我成功登录 AWS 的 SAML 响应如下，供您参考。

<saml2p:Response Destination="https://signin.aws.amazon.com/saml"
                 ID="_fc89710799c4c2c540341e94bf7132d5"
                 IssueInstant="2019-06-11T18:49:38.300Z"
                 Version="2.0"
                 xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
                 >
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://idp.example.com/idp/shibboleth</saml2:Issuer>
    <saml2p:Status>
        <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
    </saml2p:Status>
    <saml2:Assertion ID="_91749d5ecb8512c0c5d658a77cb25928"
                     IssueInstant="2019-06-11T18:49:38.300Z"
                     Version="2.0"
                     xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                     xmlns:xsd="http://www.w3.org/2001/XMLSchema"
                     >
        <saml2:Issuer>https://idp.example.com/idp/shibboleth</saml2:Issuer>
        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
            <ds:SignedInfo>
                <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
                <ds:Reference URI="#_91749d5ecb8512c0c5d658a77cb25928">
                    <ds:Transforms>
                        <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
                        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                            <ec:InclusiveNamespaces PrefixList="xsd"
                                                    xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"
                                                    />
                        </ds:Transform>
                    </ds:Transforms>
                    <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
                    <ds:DigestValue>mDAgwb9ZJxc+01sC99lAlAIAOEoiTgzHVTm4F9bdn/0=</ds:DigestValue>
                </ds:Reference>
            </ds:SignedInfo>
            <ds:SignatureValue>
LWiL3+CdU6y86zBLx3vG6na1o46EUgiN7iV+b4J2lPvZK7+Oeu6XSenJlzo/cUMT19pYYrDMM652
3lDAJCuOKPx4zTRIcabGrgzTKgmen0SHqWPxeL7t23RB6+v5AUvVw02tXqQhlggKEe3H+1T1k5q0
cGc1xw5CQtI8zE6GK7nG1INnU7mo872H9x+zM1zy3yyvrWOkHHhVFqQQ1Tu+0ev4BIhTQaVgC+pM
/ZvpctNjDMl1q4RSt1qumC+KFsYZlbrsLG7AvGJuR39wt/HV7F8Je3AUGGwMtGjkpRDuN1lIHrMq
VzFf/5eKUv20rEk3aOxoV/sMfcuhWo27+NjE1g==
</ds:SignatureValue>
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>MIIDPDCCAiSgAwIBAgIVALPPoC598LJ6ZJJJXCA2ESASlN4AMA0GCSqGSIb3DQEBCwUAMB8xHTAb
BgNVBAMMFGlkcXNhbWwuaWRxdWFudGEuY29tMB4XDTE3MDYwMjIxNDI0NloXDTM3MDYwMjIxNDI0
NlowHzEdMBsGA1UEAwwUaWRxc2FtbC5pZHF1YW50YS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IB
DwAwggEKAoIBAs4ml4G592b059YDgyD/MLWQKaKrc0/24Ufbl/JY7wOI1RpxW8DlbCvibzQge6Tu
/8LVy4GIDb8QLxmCfFKYn97HC68TgXVJ+m+sQm+e4SVg6V2q+JY94LLcoFVe8+78ZIYT23KLkTv2
RlHzes/sL1YaPSK4UuN+/ezppyX2t9BGNfuiUKA0KCf7wMFuQ07Fr65FTcGXQyxhPyaNrXjrNMJa
LqwpCaesVdVzoqPevYVN3+nzAvOWoEbi6IcwnF07D0FYren/GPRXPAk5sP6fF3X0rJCkSq+d5t5P
0gWONlvm9WlUrKadmeiibCtR2lGQ/dZGmyUzIILsuOwu4yp/EsI3AgMBAAGjbzBtMB0GA1UdDgQW
BBREpZrZlnm8YrbSFcl59WRR5IY2FTBMBgNVHREERTBDghRpZHFzYW1sLmlkcXVhbnRhLmNvbYYr
aHR0cHM6Ly9pZHFzYWQCV63ubc+tsfzCvL48k35RzLAD15DIdbS9pZHAvc2hpYmJvbGV0aDANBgk
AAOCAQEAEvrdnSvK2C2rcRr7kXn4Q/NaEovuUeqaNs1k/2+dSqs8rroM+m3Iq8RlBcmKnP/+mET3
wwUaWRxc2FtbC5pZHF1YW50YS5jb20wggEiLRXay9y1uJXyZx37RDkGu8SD7+zf8znM+TCsX/qAP
6Ve95WAeX4uB8Aeol3LULe1dePsRb/1RNpKsm8NomVzCwBXK9vyv8t3IVN40jZMaaTtR0YR22fTu
qTyIMarMPO0Eh0f1FHraYaXfyop1OJcYlISpYe+c4vNvAXwEtHkZD2Iu/2aEMGcvBo3uq6OYVDXO
fI3CvoB7sRtxURtj+vVSZKjDe6s7+lRcE1tpDkwOEEuDzA==</ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </ds:Signature>
        <saml2:Subject>
            <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
                          NameQualifier="https://idp.example.com/idp/shibboleth"
                          SPNameQualifier="urn:amazon:webservices"
                          xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                          >AAdzZWNyZXQx/wu+MEcVaUwjGOXhDKAO/5KXLD2AcDGnu1DyoP2C4ztOF01Su6tTJDytykrsv7W2dSV4FkL42ORYDiipBEuwiRSbnvViKbFBkHYN4YUmQzttx3DPNW/w42tMjLrY2iyn7sAUgQSVNGRHyMAH</saml2:NameID>
            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData Address="192.168.150.10"
                                               NotOnOrAfter="2019-06-11T18:54:38.412Z"
                                               Recipient="https://signin.aws.amazon.com/saml"
                                               />
            </saml2:SubjectConfirmation>
        </saml2:Subject>
        <saml2:Conditions NotBefore="2019-06-11T18:49:38.300Z"
                          NotOnOrAfter="2019-06-11T18:54:38.300Z"
                          >
            <saml2:AudienceRestriction>
                <saml2:Audience>urn:amazon:webservices</saml2:Audience>
            </saml2:AudienceRestriction>
        </saml2:Conditions>
        <saml2:AuthnStatement AuthnInstant="2019-06-11T18:49:38.041Z"
                              SessionIndex="_79ee919a4e3fcd2f6d13702b60bfd357"
                              >
            <saml2:SubjectLocality Address="192.168.150.10" />
            <saml2:AuthnContext>
                <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
            </saml2:AuthnContext>
        </saml2:AuthnStatement>
        <saml2:AttributeStatement>
            <saml2:Attribute FriendlyName="Role"
                             Name="https://aws.amazon.com/SAML/Attributes/Role"
                             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                             >
                <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                      xsi:type="xsd:string"
                                      >arn:aws:iam::my-aws-id:role/shibbolethidp,arn:aws:iam::my-aws-id:saml-provider/Shibboleth-IdP</saml2:AttributeValue>
            </saml2:Attribute>
            <saml2:Attribute FriendlyName="RoleSessionName"
                             Name="https://aws.amazon.com/SAML/Attributes/RoleSessionName"
                             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                             >
                <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                      xsi:type="xsd:string"
                                      >winston.hong@example.com</saml2:AttributeValue>
            </saml2:Attribute>
        </saml2:AttributeStatement>
    </saml2:Assertion>
</saml2p:Response>

(3) Amazon AWS 提供配置指南How to Use Shibboleth for Single Sign-On to the AWS Management Console。

Shibboleth 提供配置指南Shibboleth IdP with Amazon Cognito

(4) How to build and run Shibboleth SAML IdP and SP using Docker container at GitHub repository 提供了关于使用 Shibboleth SAML IdP 和 OpenLDAP 构建基于 SAML 的身份验证/授权提供程序的说明。

Shibboleth SAML IdP 负责身份联合。
OpenLDAP 负责身份认证。

(I) 我已经验证了由 Docker 运行的 Shibboleth SAML IdP（身份提供者）和 OpenLDAP 为以下企业应用程序提供的 SAML 单点登录 (SSO)。换句话说，我利用 Docker 运行的 Shibboleth SAML IdP 和 OpenLDAP 成功登录到以下企业应用程序。

Microsoft Office 365
Google G Suite
Salesforce
Dropbox
Box
Amazon AWS
OpenStack
Citrix NetScaler
VMware vCloud Director
Oracle NetSuite

(II) 我已通过 Amazon AWS 管理控制台验证Shibboleth IdP ，参考如何使用 Shibboleth 单点登录 AWS 管理控制台

(III) 我们用Java开发了我们以前版本的零密码身份验证和授权系统，并利用 Shibboleth IdP 为企业应用程序提供 SAML SSO。

我们在Scala中开发了具有可扩展性和高可用性的当前版本的零密码身份验证和授权系统，以便在没有 Shibboleth IdP 的情况下为企业应用程序本地提供 SAML SSO。

另一个 StackOverflow 问题“设置新的 Shibboleth IdP 以使用现有的 SAML SP”提供了有关 Shibboleth SAML 配置的有价值的信息和讨论。

amazon-cognito - 为什么 Cognito 拒绝我的 SAML 断言？

问题描述

解决方案

推荐阅读