对接OKTA 使用SAML2.0协议
缘起
给客户做项目，客户要求内部使用okta登陆，使用SAML2.0协议，需要对接。
okta初探
OKTA是SSO，有个网站可以让我们测试，地址：okta developer，SAML协议的交互流程大致如下
-
浏览器打开需要登录系统登陆界面，系统登陆界面只有一个登陆按钮，没有输入用户名密码的地方（原因是OKTA使用域账户登陆的时候，能直接获取域账户名，除了这个还有好多客户端都支持，比如Apple账户）
-
点击按钮，跳转到OKTA页面，这个页面只有一个loading动画，个人猜测里面有获取当前域账户名的代码
-
然后再次一个跳转，这个跳转跳到一个回调url，这个url官方名称为
Single Sign On URL，记住它，后面会用到。跳转到这个页面后，浏览器会发送一个POST请求，content-type是application/x-www-form-urlencoded，参数包含一个SAMLResponse和RelayState（这个是在OKTA控制台配置的回传参数）大概的样子是
-
第3步中的
SAMLResponse就是一个xml文档的base64编码后的数据，回调地址接收到SAMLResponse进行校验，并获取登陆名
OKTA的配置
Single Sign On URL配置我们的系统的地址，是OKTA将认证完成后告诉我们结果的一个接口，接收参数是SAMLResponse和RelayState，格式是application/x-www-form-urlencoded，java中方法签名大概是：
1@RequestMapping(value = "/login/success",method = {RequestMethod.POST}) 2 public String loginSuccess(String SAMLResponse, String RelayState){ 3 4 System.out.println("sAMLResponse:"+SAMLResponse); 5 System.out.println("RelayState:" + RelayState); 6 7 return "success"; 8 }
配置的地方如下：
2. 全部配置完后会得到一个页面大致如下
注意：Identity Provider Single Sign-On URL这个就是上面第一步中点击按钮跳转到的链接X.509 Certificate这部分是公钥，用来验证SAMLResponse中签名的公钥
3. 这个页面可以让你上传一个csv文件（包含登陆名信息）加入到你的group里面，登陆是否能成功，就是取你的域账户名，查询是否在你的group里面，当然你可以配置更复杂的规则
验证逻辑
- 引入jar包：
1 <dependency> 2 <groupId>org.opensaml</groupId> 3 <artifactId>opensaml</artifactId> 4 <version>2.6.4</version> 5 </dependency>
- 验证逻辑：
1import org.joda.time.DateTime; 2import org.joda.time.DateTimeZone; 3import org.opensaml.Configuration; 4import org.opensaml.DefaultBootstrap; 5import org.opensaml.saml2.core.Assertion; 6import org.opensaml.saml2.core.Response; 7import org.opensaml.xml.ConfigurationException; 8import org.opensaml.xml.XMLObject; 9import org.opensaml.xml.io.Unmarshaller; 10import org.opensaml.xml.io.UnmarshallerFactory; 11import org.opensaml.xml.io.UnmarshallingException; 12import org.opensaml.xml.security.x509.BasicX509Credential; 13import org.opensaml.xml.signature.Signature; 14import org.opensaml.xml.signature.SignatureValidator; 15import org.opensaml.xml.util.Base64; 16import org.opensaml.xml.validation.ValidationException; 17import org.slf4j.Logger; 18import org.slf4j.LoggerFactory; 19import org.w3c.dom.Document; 20import org.w3c.dom.Element; 21import org.xml.sax.SAXException; 22 23import javax.xml.parsers.DocumentBuilder; 24import javax.xml.parsers.DocumentBuilderFactory; 25import javax.xml.parsers.ParserConfigurationException; 26import java.io.ByteArrayInputStream; 27import java.io.IOException; 28import java.security.KeyFactory; 29import java.security.NoSuchAlgorithmException; 30import java.security.PublicKey; 31import java.security.cert.CertificateException; 32import java.security.cert.CertificateFactory; 33import java.security.cert.X509Certificate; 34import java.security.spec.InvalidKeySpecException; 35import java.security.spec.X509EncodedKeySpec; 36 37public class Test { 38 39 40 private static final Logger logger = LoggerFactory.getLogger(Test.class); 41 private static final String pattern = "yyyy-MM-dd HH:mm:ss"; 42 private static final BasicX509Credential credential = new BasicX509Credential(); 43 //X.509 Certificate 44 public static final String publicKeyStr = "xxxxxxx"; 45 //responseMsg就是SAMLResponse 46 public String validate(String responseMsg) { 47 48 49 ByteArrayInputStream byteArrayInputStream = null; 50 try { 51 CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509"); 52 byteArrayInputStream = new ByteArrayInputStream(Base64.decode(publicKeyStr)); 53 X509Certificate certificate = (X509Certificate) certificateFactory.generateCertificate(byteArrayInputStream); 54 KeyFactory keyFactory = KeyFactory.getInstance("RSA"); 55 X509EncodedKeySpec publicKeySpec = new X509EncodedKeySpec(certificate.getPublicKey().getEncoded()); 56 PublicKey publicKey = keyFactory.generatePublic(publicKeySpec); 57 credential.setPublicKey(publicKey); 58 } catch (CertificateException e) { 59 60 logger.error("加载okta PublicKey失败", e); 61 } catch (NoSuchAlgorithmException e) { 62 63 logger.error("加载okta PublicKey失败", e); 64 } catch (InvalidKeySpecException e) { 65 66 logger.error("加载okta PublicKey失败", e); 67 }finally { 68 if(byteArrayInputStream != null){ 69 try { 70 byteArrayInputStream.close(); 71 } catch (IOException e) { 72 e.printStackTrace(); 73 } 74 } 75 } 76 77 try (ByteArrayInputStream inputStream = new ByteArrayInputStream(Base64.decode(responseMsg))) { 78 DefaultBootstrap.bootstrap(); 79 DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance(); 80 documentBuilderFactory.setNamespaceAware(true); 81 DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder(); 82 Document document = documentBuilder.parse(inputStream); 83 Element documentElement = document.getDocumentElement(); 84 UnmarshallerFactory unmarshallerFactory = Configuration.getUnmarshallerFactory(); 85 Unmarshaller unmarshaller = unmarshallerFactory.getUnmarshaller(documentElement); 86 XMLObject xmlObject = unmarshaller.unmarshall(documentElement); 87 Response response = (Response) xmlObject; 88 Assertion assertion = response.getAssertions().get(0); 89 //验证签名 90 Signature signature = assertion.getSignature(); 91 SignatureValidator signatureValidator = new SignatureValidator(credential); 92 //签名验证失败会抛错 93 signatureValidator.validate(signature); 94 //校验是否登录成功 95 String successStr = response.getStatus().getStatusCode().getValue(); 96 if (!successStr.contains("Success")) { 97 logger.error("登录成功标志校验失败，successStr={}", response.getStatus().getStatusCode().getValue()); 98 return null; 99 } 100 //检验登录时间 101 DateTime notBefore = assertion.getConditions().getNotBefore(); 102 DateTime notOnOrAfter = assertion.getConditions().getNotOnOrAfter(); 103 DateTime now = new DateTime(DateTimeZone.UTC); 104 logger.error("验证okta返回的时间，notBefore={},notOnOrAfter={},now={}", 105 notBefore.toString(pattern), notOnOrAfter.toString(pattern), now.toString(pattern)); 106 if (now.isBefore(notBefore) || now.isAfter(notOnOrAfter)) { 107 logger.error("登录成功时间校验失败，notBefore={},notOnOrAfter={},now={}", 108 notBefore.toString(pattern), notOnOrAfter.toString(pattern), now.toString(pattern)); 109 return null; 110 } 111 //返回登录用户名 112 return assertion.getSubject().getNameID().getValue(); 113 114 } catch (IOException e) { 115 logger.error("验证SAMLResponse失败", e); 116 } catch (ParserConfigurationException e) { 117 logger.error("验证SAMLResponse失败", e); 118 } catch (SAXException e) { 119 logger.error("验证SAMLResponse失败", e); 120 } catch (UnmarshallingException e) { 121 logger.error("验证SAMLResponse失败", e); 122 } catch (ValidationException e) { 123 logger.error("验证SAMLResponse失败", e); 124 } catch (ConfigurationException e) { 125 logger.error("验证SAMLResponse失败", e); 126 } catch (Exception ex) { 127 logger.error("验证SAMLResponse失败", ex); 128 } 129 130 return null; 131 } 132}