[SPRING] SAML 메타 데이터 항목에 대한 서명 신뢰 설정 실패

SAML 메타 데이터 항목에 대한 서명 신뢰 설정 실패

원격 소스에서 메타 데이터를 가져 오려면 다음과 같이 ExtendedMetadataDelegate 빈을 정의했습니다.

@Bean
@Qualifier("replyMeta")
public ExtendedMetadataDelegate replyMetadataProvider() throws MetadataProviderException {
    String metadataURL = "https://ststest-replynet.reply.it/FederationMetadata/2007-06/FederationMetadata.xml";
    final Timer backgroundTaskTimer = new Timer(true);
    HTTPMetadataProvider provider = new HTTPMetadataProvider(
            backgroundTaskTimer, httpClient(), metadataURL);
    provider.setParserPool(parserPool());
    ExtendedMetadataDelegate emd = new ExtendedMetadataDelegate(
            provider, new ExtendedMetadata());
    return emd;
}

서명 신뢰 설정을 보장하기 위해 JDK 키 저장소와 응용 프로그램 키 저장소에 관련 키를 추가했습니다 (두 번째 단계로는 충분하지 않을 수도 있음). 그럼에도 불구하고 webapp을 실행하면 오류가 발생합니다.

[2014-08-18 14:36:47.200] boot - 6000 DEBUG [localhost-startStop-1] --- SignatureValidator: Attempting to validate signature using key from supplied credential
[2014-08-18 14:36:47.200] boot - 6000 DEBUG [localhost-startStop-1] --- SignatureValidator: Creating XMLSignature object
[2014-08-18 14:36:47.206] boot - 6000 DEBUG [localhost-startStop-1] --- SignatureValidator: Validating signature with signature algorithm URI: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
[2014-08-18 14:36:47.207] boot - 6000 DEBUG [localhost-startStop-1] --- SignatureValidator: Validation credential key algorithm 'RSA', key instance class 'sun.security.rsa.RSAPublicKeyImpl'
[2014-08-18 14:36:47.329] boot - 6000 DEBUG [localhost-startStop-1] --- SignatureValidator: Signature validated with key from supplied credential
[2014-08-18 14:36:47.329] boot - 6000 DEBUG [localhost-startStop-1] --- BaseSignatureTrustEngine: Signature validation using candidate credential was successful
[2014-08-18 14:36:47.330] boot - 6000 DEBUG [localhost-startStop-1] --- BaseSignatureTrustEngine: Successfully verified signature using KeyInfo-derived credential
[2014-08-18 14:36:47.330] boot - 6000 DEBUG [localhost-startStop-1] --- BaseSignatureTrustEngine: Attempting to establish trust of KeyInfo-derived credential
[2014-08-18 14:36:47.330] boot - 6000 DEBUG [localhost-startStop-1] --- BasicX509CredentialNameEvaluator: Supplied trusted names are null or empty, skipping name evaluation
[2014-08-18 14:36:47.331] boot - 6000 DEBUG [localhost-startStop-1] --- MetadataCredentialResolver: Attempting PKIX path validation on untrusted credential: [subjectName='CN=ADFS Signing - ststest-replynet.reply.it']
[2014-08-18 14:36:47.346] boot - 6000 ERROR [localhost-startStop-1] --- MetadataCredentialResolver: PKIX path construction failed for untrusted credential: [subjectName='CN=ADFS Signing - ststest-replynet.reply.it']: unable to find valid certification path to requested target
[2014-08-18 14:36:47.347] boot - 6000 DEBUG [localhost-startStop-1] --- PKIXSignatureTrustEngine: Signature trust could not be established via PKIX validation of signing credential
[2014-08-18 14:36:47.347] boot - 6000 DEBUG [localhost-startStop-1] --- BaseSignatureTrustEngine: Failed to establish trust of KeyInfo-derived credential
[2014-08-18 14:36:47.347] boot - 6000 DEBUG [localhost-startStop-1] --- BaseSignatureTrustEngine: Failed to verify signature and/or establish trust using any KeyInfo-derived credentials
[2014-08-18 14:36:47.347] boot - 6000 DEBUG [localhost-startStop-1] --- PKIXSignatureTrustEngine: PKIX validation of signature failed, unable to resolve valid and trusted signing key
[2014-08-18 14:36:47.347] boot - 6000 ERROR [localhost-startStop-1] --- SignatureValidationFilter: Signature trust establishment failed for metadata entry http://ststest-replynet.reply.it/adfs/services/trust
[2014-08-18 14:36:47.349] boot - 6000 ERROR [localhost-startStop-1] --- AbstractReloadingMetadataProvider: Error filtering metadata from https://ststest-replynet.reply.it/FederationMetadata/2007-06/FederationMetadata.xml
org.opensaml.saml2.metadata.provider.FilterException: Signature trust establishment failed for metadata entry

다음과 같이 설정하면 오류가 사라집니다.

emd.setMetadataTrustCheck(false); 

... 사용 된 메타 데이터를 확인하고 싶습니다.

이 오류를 해결할 수있는 방법이 있습니까?

다음과 같이 ExtendedMetadata를 설정하려고했지만 오류가 지속됩니다.

em.setAlias("defaultAlias");
em.setSigningKey("*.reply.it (Go Daddy Secure Certification Authority)");

해결법

1. ==============================

   1.대부분 HTTPS 인증서를 가져 왔지만 서명을 만드는 데 사용 된 인증서는 가져 오지 않았습니다. 너는해야한다 :

   대부분 HTTPS 인증서를 가져 왔지만 서명을 만드는 데 사용 된 인증서는 가져 오지 않았습니다. 너는해야한다 :

   이것으로 Tomcat을 다시 시작하면 메타 데이터 로딩이 끝납니다.

   HTTP 클라이언트 (Spring SAML 1.0.0.RELEASE에서 사용 가능)를 구성하는 다음 bean을 포함하는 경우 JDK의 cacerts에 HTTPS 인증서를 포함 할 필요가 없습니다.

    <bean class="org.springframework.security.saml.trust.httpclient.TLSProtocolConfigurer"/>
   

from https://stackoverflow.com/questions/25363676/signature-trust-establishment-failed-for-saml-metadata-entry by cc-by-sa and MIT license