C# 在C中验证Java SAML响应#

我在看关于验证Java在C#中生成的SAML响应的各种帖子。我一直在尝试所有的建议，但仍然从

SignedXml.CheckSignature

中得到一个错误，我完全不知道什么可能是错误的，我正在联系你们，看看你们是否有我可以使用的建议

响应中的签名节点是

 <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
  <ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
   <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
   <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
   <ds:Reference URI="#SM16afb708b851b15451d92108ac8c6a2a627a2643667" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:Transforms xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
     <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
     <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
    </ds:Transforms>
    <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
    <ds:DigestValue xmlns:ds="http://www.w3.org/2000/09/xmldsig#">kOlL02M8icLI1MtFnFUAcf/yols=</ds:DigestValue>
   </ds:Reference>
  </ds:SignedInfo>
  <ds:SignatureValue xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
   d2wjnwPdzDrsWvMq9EElkb0TVsj8LmMXqTusPuG3GbxsqVLFryqaMkwv/whTYD/evw8WNClJm1nC
   VpGTEPEB/voPiFJaNpdwvs6a6PuTizLQQaqOC1H6JC6KboUVR87wuJ4kV3W9QoGEft+OmZXMgUU6
   54PgOX3d/czqlQWS9Z8=
  </ds:SignatureValue>
  <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
   <ds:X509Data xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:X509Certificate xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
     MIICCjCCAXOgAwIBAgIQazR4XEyfFItIKZvB/IC3/jANBgkqhkiG9w0BAQQFADATMREwDwYDVQQD
     EwhTYW1sVGVzdDAgFw0wMDAxMDEwNDAwMDBaGA8yMDk5MDEwMTA0MDAwMFowEzERMA8GA1UEAxMI
     U2FtbFRlc3QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAK4kfW9Jg/WtQ+4yy631r2qkCVyK
     odGL0A3lg+4w3BfCSGf4N7GkAlHI4G582tC4tlwd/mj/IvN6qxhIyu45OlENZhWOXFOCogoX7Tfx
     Vd7XRUqNwdndjy9KY7uyIrXVczpGbk+ahp6SS0NAG9i1rYR/pxTvW4zUHkrFbgm8gdghAgMBAAGj
     XTBbMBMGA1UdJQQMMAoGCCsGAQUFBwMDMEQGA1UdAQQ9MDuAEHITUeo8fKKVys7DcdV65hmhFTAT
     MREwDwYDVQQDEwhTYW1sVGVzdIIQazR4XEyfFItIKZvB/IC3/jANBgkqhkiG9w0BAQQFAAOBgQA/
     Dm+yk4K3q8AG3q4dorWswL8fwU9dpjuvheRjAveaL5kr59QRanG+lLi8Wefg6iTPKDgIGc2VG13T
     KP7pZSysaXJ5i8N0zCg+eu/YL7Hw1kSXW/CdxwQ+qI1W53fQ9NXlLVWPXhIepAOL46EEZgACHEhv
     tG30XtStycyLOsgm9A==
    </ds:X509Certificate>
   </ds:X509Data>
  </ds:KeyInfo>
 </ds:Signature>

try
{
    XmlDocument xmlDoc = new XmlDocument();
    xmlDoc.PreserveWhitespace = true;
    xmlDoc.Load(@"C:\SAMLSSOResponse.txt");

    XmlNamespaceManager _documentNamespaceManager;
    _documentNamespaceManager = new XmlNamespaceManager(xmlDoc.NameTable);
    _documentNamespaceManager.AddNamespace("ds", "http://www.w3.org/2000/09/xmldsig#");
    _documentNamespaceManager.AddNamespace("samlp", "urn:oasis:names:tc:SAML:1.0:protocol");
    _documentNamespaceManager.AddNamespace("saml", "urn:oasis:names:tc:SAML:1.0:assertion");

    SignedXml signedXml = new SignedXml(xmlDoc);
    XmlNodeList nodeList = xmlDoc.GetElementsByTagName("ds:Signature");

    XmlNode xmlNode = xmlDoc.DocumentElement.SelectSingleNode("/samlp:Response/ds:Signature", _documentNamespaceManager);
    //xmlDoc.GetElementsByTagName("Signature");
    //signedXml.LoadXml((XmlElement)xmlNode);
    signedXml.LoadXml((XmlElement)nodeList[0]);

    X509Certificate2 certificate = null;
    foreach (KeyInfoClause clause in signedXml.KeyInfo)
    {
        if (clause is KeyInfoX509Data)
        {
            if (((KeyInfoX509Data)clause).Certificates.Count > 0)
            {
                certificate = (X509Certificate2)((KeyInfoX509Data)clause).Certificates[0];
            }
        }
    }

    if (certificate == null)
    {
        Console.WriteLine("No Certificate found");
    }

    Console.WriteLine("Testing with Certificate in the XML");
    if (signedXml.CheckSignature(certificate, true))
        Console.WriteLine("Validated");
    else
        Console.WriteLine("Failed");
}
catch (Exception ex)
{
}

我甚至试图通过在代码中加载证书来验证签名，但仍然遇到同样的问题

---

有人对签名未被验证的原因有什么建议吗？

我解决了这个问题。我必须处理多个问题：

我正在处理的响应是我得到的字符串，没有进行验证。当我得到Base64编码的字符串，然后尝试验证它时，给了我一个不同的错误（格式错误的引用元素），该错误通过步骤2得到解决

通过创建从SignedXML继承的新类，然后覆盖GetIdeElement类，解决了格式错误的引用元素问题。以下是代码：

公共类SamlSignedXml:SignedXml { 私有字符串_referenceAttributeId=“”； 公共SamlSignedXml（XmlElement元素，字符串引用属性ID） ：基础（元素） { _referenceAttributeId=referenceAttributeId； } 公共覆盖XmlElement GetIdeElement( XmlDocument文档，字符串idValue） { 返回（XmlElement） document.SelectSingleNode( string.Format（“/*[@{0}='{1}']”， _referenceAttributeId，idValue））； } } 当您创建SamlSignedXml类的实例时，可以执行以下操作： SamlSignedXml signedXml=新的SamlSignedXml（元素，“ResponseID”）

其中元素是XmlDocument.DocumentElement

这就解决了问题

public class SamlSignedXml : SignedXml { private string _referenceAttributeId = ""; public SamlSignedXml(XmlElement element, string referenceAttributeId) : base(element) { _referenceAttributeId = referenceAttributeId; } public override XmlElement GetIdElement( XmlDocument document, string idValue) { return (XmlElement) document.SelectSingleNode( string.Format("//*[@{0}='{1}']", _referenceAttributeId, idValue)); } }