SP 发起的 SSO 和 IDP 发起的 SSO 之间的 SAML 响应差异

Question

如何从 SAML 响应中判断它是 SP 发起的 SSO 还是 IDP 发起的 SSO？是否有一个属性告诉我是谁发起了 SSO？

例如，在这个 Whosebug 问题中：Differences between SP initiated SSO and IDP initiated SSO 他们讨论了差异，但没有谈论 XML 级别本身...

SAML 响应如下所示：

<samlp:Response xmlns:samlp ="urn:oasis:names:tc:SAML:2 .0 :protocol" Destination ="http: //my - sp . com /sso /saml" ID ="_45307c23795120" IssueInstant ="2014 -03 -07 T08:30:00Z" Version ="2.0">
    <saml:Issuer xmlns:saml ="urn:oasis:names:tc:SAML:2 .0 :assertion">http: //my - idp . com </saml:Issuer>
    <samlp:Status>
        <samlp:StatusCode Value ="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </samlp:Status>
    <saml:Assertion ID ="ebe015e8be2a" IssueInstant="2014-03-07T08:30:00Z" Version ="2.0">
        <saml:Issuer> http: //my - idp . com </saml:Issuer>
        <ds:Signature xmlns:ds ="http: //www . w3 . org /2000/09/xmldsig #">
            <ds:SignedInfo>
                <ds:CanonicalizationMethod Algorithm ="http: //www . w3 . org /2001/10/xml - exc - c14n #"/>
                <ds:SignatureMethod Algorithm ="http: //www . w3 . org /2000/09/ xmldsig # rsa - sha1"/>
                <ds:Reference URI ="# ebe015e8be2a">
                    <ds:Transforms>
                        <ds:Transform Algorithm ="http: //www . w3 . org /2000/09/ xmldsig # enveloped - signature"/>
                        <ds:Transform Algorithm ="http: //www . w3 . org /2001/10/xml - exc - c14n #"/>
                    </ds:Transforms>
                    <ds:DigestMethod Algorithm ="http: //www . w3 . org /2000/09/ xmldsig # sha1"/>
                    <ds:DigestValue> ... </ds:DigestValue>
                </ds:Reference>
            </ds:SignedInfo>
            <ds:SignatureValue> ... </ds:SignatureValue>
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate> ... </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </ds:Signature>
        <saml:Subject>
            <saml:NameID Format ="urn:oasis:names:tc:SAML:2 .0 :nameid - format:persistent" NameQualifier ="http: //my - idp . com" SPNameQualifier ="http: //my - sp . com /sso /saml"> NDSUser </saml:NameID>
            <saml:SubjectConfirmation Method ="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml:SubjectConfirmationData NotOnOrAfter ="2014 -03 -07 T10:45:00Z" Recipient ="http: //my - sp . com /sso /saml"/>
            </saml:SubjectConfirmation>
        </saml:Subject>
        <saml:Conditions NotBefore ="2014 -03 -07 T08:29:00Z" NotOnOrAfter="2014 -03 -07 T10:46:00Z">
            <saml:AudienceRestriction>
                <saml:Audience> http: //my - sp . com /sso /saml </saml:Audience>
            </saml:AudienceRestriction>
        </saml:Conditions>
        <saml:AuthnStatement AuthnInstant="2014 -03 -07 T08:25:56Z" SessionIndex="f7810a8c86a6">
            <saml:AuthnContext>
                <saml:AuthnContextClassRef> urn:oasis:names:tc:SAML:2 .0:ac:classes:PasswordProtectedTransport </saml:AuthnContextClassRef>
            </saml:AuthnContext>
        </saml:AuthnStatement>
        <saml:AttributeStatement>
            <saml:Attribute Name ="FEDERATION_ID">
                <saml:AttributeValue xmlns:xs ="http: //www . w3 . org /2001/XMLSchema" xmlns:xsi ="http: //www . w3 . org /2001/XMLSchema - instance" xsi:type ="xs:string"> NDS </saml:AttributeValue>
            </saml:Attribute>
        </saml:AttributeStatement>
    </saml:Assertion>
</samlp:Response>

Answer 1

来自 SP 发起的 SSO 流的 SAML 响应具有 'InResponseTo' 属性。

SP 发起的 SSO 和 IDP 发起的 SSO 之间的 SAML 响应差异

SAML reponse difference between SP initiated SSO and IDP initiated SSO

single-sign-on

saml