ITfoxtec.Identity.Saml2 无效 URI 问题

Question

当我将 <TargetFramework>net462</TargetFramework> 用于我的 Okta SAML 实现时，这会抛出一个无效的 URL 当它 new Saml2AuthnRequest(config); 但在我第一次尝试在 netcoreapp3.1 上使用此代码时，它起作用了非常好。如果我遗漏了什么，请告诉我谢谢。

[HttpGet, AllowAnonymous]
    public IActionResult Index(string returnUrl = null)
    {
        try
        {
            var config = GetSAMLConfig();
            var binding = new Saml2RedirectBinding();
            binding.SetRelayStateQuery(new Dictionary<string, string> { { relayStateReturnUrl, returnUrl ?? Url.Content("~/") } });
            var request = new Saml2AuthnRequest(config);
            return binding.Bind(request).ToActionResult();
        }
        catch (Exception e)
        {
            Console.WriteLine(e);
            throw;
        }
    }

   private Saml2Configuration GetSAMLConfig()
    {
        var config = new Saml2Configuration();
        config.AllowedAudienceUris.Add("Okta_SAML_Example");
        config.CertificateValidationMode = X509CertificateValidationMode.ChainTrust;
        config.RevocationMode = X509RevocationMode.NoCheck;

        var entityDescriptor = new EntityDescriptor();
        entityDescriptor.ReadIdPSsoDescriptorFromUrl(new Uri("https://---------.okta.com/app/exk2b0b7dibno7rOB5d6/sso/saml/metadata"));
        if (entityDescriptor.IdPSsoDescriptor != null)
        {
            config.SingleSignOnDestination = entityDescriptor.IdPSsoDescriptor.SingleSignOnServices.First().Location;
            config.SignatureValidationCertificates.AddRange(entityDescriptor.IdPSsoDescriptor.SigningCertificates);
        }
        else
        {
            throw new Exception("IdPSsoDescriptor not loaded from metadata.");
        }

        return config;
    }

实际异常

System.UriFormatException: Invalid URI: The format of the URI could not be determined.
   at System.Uri.CreateThis(String uri, Boolean dontEscape, UriKind uriKind)
   at ITfoxtec.Identity.Saml2.Configuration.Saml2IdentityConfiguration.GetAudienceRestriction(Boolean audienceRestricted, IEnumerable`1 allowedAudienceUris)
   at ITfoxtec.Identity.Saml2.Configuration.Saml2IdentityConfiguration.GetIdentityConfiguration(Saml2Configuration config)
   at ITfoxtec.Identity.Saml2.Saml2Request..ctor(Saml2Configuration config)
   at ITfoxtec.Identity.Saml2.Saml2AuthnRequest..ctor(Saml2Configuration config)
   at SAMLNet461.Controllers.HomeController.Index(String returnUrl) in D:\REPO\PELICAN\LOCAL\SAML.RND - CompanyAcccounts adjustment\SAML.Demo\SAMLNet461\Controllers\HomeController.cs:line 69
   at lambda_method(Closure , Object , Object[] )
   at Microsoft.AspNetCore.Mvc.Internal.ActionMethodExecutor.SyncActionResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)
   at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.<InvokeActionMethodAsync>d__12.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.<InvokeNextActionFilterAsync>d__10.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.Rethrow(ActionExecutedContext context)
   at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.<InvokeInnerFilterAsync>d__13.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.<InvokeNextResourceFilter>d__23.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.Rethrow(ResourceExecutedContext context)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.<InvokeFilterPipelineAsync>d__18.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.<InvokeAsync>d__16.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Builder.RouterMiddleware.<Invoke>d__4.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware.<Invoke>d__7.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.<Invoke>d__7.MoveNext()

Answer 1

代码看起来正确。

可能是 TLS 版本问题。

另一种解决方案是下载代码中的元数据并将元数据字符串添加到 ITfoxtec Identity SAML 2.0 库：

var idPMetadataXml = "... downloaded metadata ...";
var entityDescriptor = new EntityDescriptor();
entityDescriptorReadIdPSsoDescriptor(idPMetadataXml);
...

更新：

与观众限制相关的错误接缝：

config.AllowedAudienceUris.Add("Okta_SAML_Example");

受众必须是 .NET Framework 应用程序中的 URI。纯文本字符串仅在 .NET Core 和 .NET 5.0 中受支持。

.NET 框架示例：https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2/tree/master/test/TestWebApp

Answer 2

我遇到了同样的问题，它是由“GetAudienceRestriction() 方法”引起的。将发行者名称从“application-name”更改为“https://application-name”有帮助。不要忘记在您的身份提供者端（Okta、Ping Identity 等）一致地更改您的名字。现在不再抛出异常。

ITfoxtec.Identity.Saml2 无效 URI 问题

ITfoxtec.Identity.Saml2 Invalid URI Issue

c#

saml-2.0

.net-4.6.2

itfoxtec-identity-saml2