如何修复错误状态400消息无法验证SAML上的响应?

JFrog支持
2023-01-22十一10

受影响版本:4.5.1到4.7.5

修正版本:4.7.6及以上

决议:升级人工4.7.6或以上

问题:

当您使用SAML登录Artifactory时,输入凭据并登录后可能会看到以下错误:

{

"errors": [{

"status": 400,

“消息”:“{\“错误\”,\“无法验证反应\“}”

})

}

在人工日志中,您可以看到以下内容

2016-05-10 16:05:01 1702 [http-nio-8081-exec-4] [WARN] (o.a.x.s.s.XMLSignature:-1) -签名验证失败。

2016-05-10 16:05:01 1,708 [http-nio-8081- exc -4] [ERROR] (o.a.u.r.s.a.s.s.GetSamlLoginResponseService:29) -验证响应失败

samlexception:验证响应失败

(SamlUtils.java:396) ~[artifactory-addon-sso-4.5.1.jar:na]

在org.artifactory.add .sso. samlhandlerimpl . verifsignsignature (SamlHandlerImpl.java:211) ~[artifactory-addon-sso-4.5.1.jar:na]

在org.artifactory.addon.sso. samlhandlerimpl . handleloginresponse (SamlHandlerImpl.java:85) ~[artifactory-addon-sso-4.5.1.jar:na]

(GetSamlLoginResponseService.java:27) ~[artifactory-rest-ui-4.5.1.jar:na]

在org.artifactory.rest.common.service.ServiceExecutor.process(ServiceExecutor.java:18)

[artifactory-rest-common-4.5.1.jar:na]

(SamLoginLogoutResource.java:40) [artifactory-rest-ui-4.5.1.jar:na]

在sun.reflect.NativeMethodAccessorImpl。invoke0(原生方法)~[na:1.8.0_71]

@ sun.reflect. nativeemethodaccessorimpl .invoke(nativeemethodaccessorimpl .java:62) ~[na:1.8.0_71]

[na:1.8.0_71]

at java.lang.reflect.Method.invoke(Method.java:497) ~[na:1.8.0_71]

JavaMethodInvokerFactory.java:60) [jersey-server-1.19.jar:1.19]

$ResponseOutInvoker._dispatch(AbstractResourceMethodDispatchProvider.java:205) [jerseyserver -1.19.jar:1.19]

[jersey-server . 1.19.jar:1.19]

HttpMethodRule.java:302) [jersey-server-1.19.jar:1.19]

right thandpathrule .java:147 [jersey-server-1.19.jar:1.19]

[footnoteref:1]

right thandpathrule .java:147 [jersey-server-1.19.jar:1.19]

[footnoter.com .sun. server.impl.uri.rules. rootresourceclassesrule .accept]

(WebApplicationImpl.java:1542) [jersey-server-1.19.jar:1.19]

(WebApplicationImpl.java:1473) [jersey-server-1.19.jar:1.19]

(WebApplicationImpl.java:1419) [jersey-server-1.19.jar:1.19]

(WebApplicationImpl.java:1409) [jerseyserver1.19 .jar:1.19]

(WebComponent.java:409) [jersey-servlet-1.19.jar:1.19]

servletcontainer .service(ServletContainer.java:558) [jersey-servlet-1.19.jar:1.19]

servletcontainer .service(ServletContainer.java:733) [jersey-servlet-1.19.jar:1.19]

[servlet-api.jar:na]

[catalina.jar:8.0.22]

[catalina.jar:8.0.22]

[artifactory-web-application .servlet. repofilter .execute(RepoFilter.java:198)]

[artifactory-web-application .servlet. repofilter . dofilter]

[catalina.jar:8.0.22]

[catalina.jar:8.0.22]

(AccessFilter.java:334) [artifactory-web-application-4.5.1.jar:na]

(AccessFilter.java:309) [artifactory-web-application-4.5.1.jar:na]

[artifactory-web-application .servlet. accessfilter . dofilterinternal (AccessFilter.java:192)]

(AccessFilter.java:156) [artifactory-web-application-4.5.1.jar:na]

[catalina.jar:8.0.22]

[catalina.jar:8.0.22]

[artifactory-web-application-4.5.1.jar:na]

[catalina.jar:8.0.22]

[catalina.jar:8.0.22]

[ArtifactoryFilter.java:109] [artifactory-web-application-4.5.1.jar:na]

[catalina.jar:8.0.22]

[catalina.jar:8.0.22]

[catalina.jar:8.0.22]

[catalina.jar:8.0.22]

[catalina.jar:8.0.22]

[catalina.jar:8.0.22]

[artifactory-web-application .servlet.redirect . samlredirectionhandler .redirect]

[artifactory-web-application .servlet. artifactoryfilter . dofilter]

[catalina.jar:8.0.22]

[catalina.jar:8.0.22]

[catalina.jar:8.0.22]

[catalina.jar:8.0.22]

[catalina.jar:8.0.22]

[catalina.jar:8.0.22]

[catalina.jar:8.0.22]

CoyoteAdapter.java:518 . [catalina.jar:8.0.22]

abstract: thttp11processor .java:1091) [tomcat-coyote.jar:8.0.22]

AbstractProtocol.java:668 [tomcat-coyote.jar:8.0.22]

[tomcat-coyote.jar:8.0.22]

[tomcat-coyote.jar:8.0.22]

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [na:1.8.0_71]

在java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [na:1.8.0_71]

[tomcat-util.jar:8.0.22]

at java.lang.Thread.run(Thread.java:745) [na:1.8.0_71]

由于:org.opensaml.xml. validate . validationexception:签名没有根据凭证的密钥进行验证

在org.opensaml.xml.signature.SignatureValidator.validate(SignatureValidator.java:78) ~[xmltool-1.3.2 .jar:na]

在org.artifactory.addon.sso. samlutils . verifysamlloginresponse (SamlUtils.java:394) ~

…66个常用框架省略