如何使用openssl（.PCKS8）文件签署saml 2.0声明

Question

您好，我需要关于saml 2.0 Authn请求的一些信息。我想用openssl创建的* .pkcs8文件签署我的authn请求。我可以使用java keytool来处理密钥库文件。但是我想使用openssl生成* .PKCS8文件来实现相同的功能。我一直在为此奋斗一段时间。我可以用它生成xml。

// Authn请求...

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="http://localhost:8080/sp/AssertionConsumerService" Destination="http://localhost:8080/idp/SingleSignOnService" ID="95cc3943-67dd-43ef-809b-2ccd8bd3e4e9" IssueInstant="2013-04-26T12:18:48.799Z" Version="2.0"> 
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">sp</saml:Issuer> 
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> 
    <ds:SignedInfo> 
     <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
     <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/> 
     <ds:Reference URI="#95cc3943-67dd-43ef-809b-2ccd8bd3e4e9"> 
     <ds:Transforms> 
      <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/> 
      <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> 
      <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" 
       PrefixList="ds saml samlp"/> 
      </ds:Transform> 
     </ds:Transforms> 
     <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> 
     <ds:DigestValue>2HkVe/KnVzcMgneRUItjq2V/FEA=</ds:DigestValue> 
     </ds:Reference> 
    </ds:SignedInfo> 
    <ds:SignatureValue> 
      NjCxy8R3NjkN8B932FJolGTqtYTBBTLboHUo7ZqEXxICUW/ZhOV2Pwe+c4R0/TrPqBPVZBItlXyv 
      at3edIMrr7RlEFGy3rt7pPVRXUcmF6jtDZajCpwwaEKKD--REMOVED SOME CODE------------ 
      egb8dua65WhY1KkugNPG4FWTVhtzul/CBo9a8vN/ZuXRbZQ6sUWbq1BFgC6Zmw8kr1aUNBwqRi7r 
      ZNPXcGVhXuFQTTV4Kuc1eiI1lgANKLTrkCBRSw== 
    </ds:SignatureValue> 
    </ds:Signature> 
</samlp:AuthnRequest> 

// END

我无法得到密钥信息，并且我能够使用Java keytool获得x509data和证书值。

<ds:KeyInfo> 
     <ds:X509Data> 
     <ds:X509Certificate>hZB2kOYypWs33Bs2BTaKZOKGig0CAwEAATANBgkqhkiG9w0BAQUFAAOB 
     gQB3Cfe0iTfrXY9E22TFy5b87kwpDKjLopNLtX3kqSUlfjnbN5tYN4zr91H5dZUkuFF83z7ztzKi 
     zkcxiMgVVQkU2X1bn5SdErvmS7aEcG8+5TdlO5bf+8as04u5qug+oQun5s1t9mSvaF7Ol5CX/gkp 
     EUTjXx28kldbY7ETgDUrSw==</ds:X509Certificate> 
     </ds:X509Data> 
    </ds:KeyInfo> 
    </ds:Signature> 

也告诉我是我的验证申请完成。 也是对神器和POST（断言）saml消息相同的Authn请求

PLS帮助!!!

Answer 1

您可以用它来输出的密钥信息

X509KeyInfoGeneratorFactory fact = new X509KeyInfoGeneratorFactory(); 
fact.setEmitEntityCertificate(true); 
signature.setKeyInfo(fact.newInstance().generate(cred)); 

Answer 2

你如何构建你的org.opensaml.xml.security.credential.Credential对象？ 您只能从PKCS8文件加载private-key。您仍需要公钥才能完全构建Credential对象。如果您的公共密钥存储在DER编码字节你可以使用下面的代码来创建Credential并用它来签名的请求

/** 
* Load privateKeyDerBytes from PKCS8 file and publicKeyDerBytes from .cer, .crt, .der files 
*/ 
private static Credential getCredential(byte[] privateKeyDerBytes , byte[] publicKeyDerBytes) throws IOException 
{ 
    PrivateKey privateKey = PKCS8Key.parse(new DerValue(privateKeyDerBytes)); 
    PublicKey publicKey = X509Key.parse(new DerValue(publicKeyDerBytes)); 
    BasicCredential basicCredential = new BasicCredential(); 
    basicCredential.setUsageType(UsageType.SIGNING); 
    basicCredential.setPrivateKey(privateKey); 
    basicCredential.setPublicKey(publicKey); 
    return basicCredential; 
} 

public static void signAssertion(Assertion assertion , byte[] privateKeyDerBytes , byte[] publicKeyDerBytes) throws IOException, SecurityException 
{ 
    // get Credential 
    Credential credential = getCredential(privateKeyDerBytes, publicKeyDerBytes); 
    // create Signature 
    Signature signature = (Signature) Configuration.getBuilderFactory().getBuilder(
      Signature.DEFAULT_ELEMENT_NAME).buildObject(
      Signature.DEFAULT_ELEMENT_NAME); 

    signature.setSigningCredential(credential); 
    signature 
      .setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1); 
    signature 
      .setCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS); 
    signature.setKeyInfo(getKeyInfo(credential)); 

    assertion.setSignature(signature); 

} 

public static KeyInfo getKeyInfo(Credential credential) 
     throws SecurityException { 
    SecurityConfiguration secConfiguration = Configuration 
      .getGlobalSecurityConfiguration(); 
    NamedKeyInfoGeneratorManager namedKeyInfoGeneratorManager = secConfiguration 
      .getKeyInfoGeneratorManager(); 
    KeyInfoGeneratorManager keyInfoGeneratorManager = namedKeyInfoGeneratorManager 
      .getDefaultManager(); 
    KeyInfoGeneratorFactory factory = keyInfoGeneratorManager 
      .getFactory(credential); 
    KeyInfoGenerator generator = factory.newInstance(); 
    return generator.generate(credential); 

}