如何修复错误状态400消息无法验证SAML上的响应?
受影响版本:4.5.1到4.7.5
修正版本:4.7.6及以上
决议:升级人工4.7.6或以上
问题:
当您使用SAML登录Artifactory时,输入凭据并登录后可能会看到以下错误:
{
"errors": [{
"status": 400,
“消息”:“{\“错误\”,\“无法验证反应\“}”
})
}
在人工日志中,您可以看到以下内容
2016-05-10 16:05:01 1702 [http-nio-8081-exec-4] [WARN] (o.a.x.s.s.XMLSignature:-1) -签名验证失败。
2016-05-10 16:05:01 1,708 [http-nio-8081- exc -4] [ERROR] (o.a.u.r.s.a.s.s.GetSamlLoginResponseService:29) -验证响应失败
samlexception:验证响应失败
(SamlUtils.java:396) ~[artifactory-addon-sso-4.5.1.jar:na]
在org.artifactory.add .sso. samlhandlerimpl . verifsignsignature (SamlHandlerImpl.java:211) ~[artifactory-addon-sso-4.5.1.jar:na]
在org.artifactory.addon.sso. samlhandlerimpl . handleloginresponse (SamlHandlerImpl.java:85) ~[artifactory-addon-sso-4.5.1.jar:na]
(GetSamlLoginResponseService.java:27) ~[artifactory-rest-ui-4.5.1.jar:na]
在org.artifactory.rest.common.service.ServiceExecutor.process(ServiceExecutor.java:18)
[artifactory-rest-common-4.5.1.jar:na]
(SamLoginLogoutResource.java:40) [artifactory-rest-ui-4.5.1.jar:na]
在sun.reflect.NativeMethodAccessorImpl。invoke0(原生方法)~[na:1.8.0_71]
@ sun.reflect. nativeemethodaccessorimpl .invoke(nativeemethodaccessorimpl .java:62) ~[na:1.8.0_71]
[na:1.8.0_71]
at java.lang.reflect.Method.invoke(Method.java:497) ~[na:1.8.0_71]
JavaMethodInvokerFactory.java:60) [jersey-server-1.19.jar:1.19]
$ResponseOutInvoker._dispatch(AbstractResourceMethodDispatchProvider.java:205) [jerseyserver -1.19.jar:1.19]
[jersey-server . 1.19.jar:1.19]
HttpMethodRule.java:302) [jersey-server-1.19.jar:1.19]
right thandpathrule .java:147 [jersey-server-1.19.jar:1.19]
[footnoteref:1]
right thandpathrule .java:147 [jersey-server-1.19.jar:1.19]
[footnoter.com .sun. server.impl.uri.rules. rootresourceclassesrule .accept]
(WebApplicationImpl.java:1542) [jersey-server-1.19.jar:1.19]
(WebApplicationImpl.java:1473) [jersey-server-1.19.jar:1.19]
(WebApplicationImpl.java:1419) [jersey-server-1.19.jar:1.19]
(WebApplicationImpl.java:1409) [jerseyserver1.19 .jar:1.19]
(WebComponent.java:409) [jersey-servlet-1.19.jar:1.19]
servletcontainer .service(ServletContainer.java:558) [jersey-servlet-1.19.jar:1.19]
servletcontainer .service(ServletContainer.java:733) [jersey-servlet-1.19.jar:1.19]
[servlet-api.jar:na]
[catalina.jar:8.0.22]
[catalina.jar:8.0.22]
[artifactory-web-application .servlet. repofilter .execute(RepoFilter.java:198)]
[artifactory-web-application .servlet. repofilter . dofilter]
[catalina.jar:8.0.22]
[catalina.jar:8.0.22]
(AccessFilter.java:334) [artifactory-web-application-4.5.1.jar:na]
(AccessFilter.java:309) [artifactory-web-application-4.5.1.jar:na]
[artifactory-web-application .servlet. accessfilter . dofilterinternal (AccessFilter.java:192)]
(AccessFilter.java:156) [artifactory-web-application-4.5.1.jar:na]
[catalina.jar:8.0.22]
[catalina.jar:8.0.22]
[artifactory-web-application-4.5.1.jar:na]
[catalina.jar:8.0.22]
[catalina.jar:8.0.22]
[ArtifactoryFilter.java:109] [artifactory-web-application-4.5.1.jar:na]
[catalina.jar:8.0.22]
[catalina.jar:8.0.22]
[catalina.jar:8.0.22]
[catalina.jar:8.0.22]
[catalina.jar:8.0.22]
[catalina.jar:8.0.22]
[artifactory-web-application .servlet.redirect . samlredirectionhandler .redirect]
[artifactory-web-application .servlet. artifactoryfilter . dofilter]
[catalina.jar:8.0.22]
[catalina.jar:8.0.22]
[catalina.jar:8.0.22]
[catalina.jar:8.0.22]
[catalina.jar:8.0.22]
[catalina.jar:8.0.22]
[catalina.jar:8.0.22]
CoyoteAdapter.java:518 . [catalina.jar:8.0.22]
abstract: thttp11processor .java:1091) [tomcat-coyote.jar:8.0.22]
AbstractProtocol.java:668 [tomcat-coyote.jar:8.0.22]
[tomcat-coyote.jar:8.0.22]
[tomcat-coyote.jar:8.0.22]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [na:1.8.0_71]
在java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [na:1.8.0_71]
[tomcat-util.jar:8.0.22]
at java.lang.Thread.run(Thread.java:745) [na:1.8.0_71]
由于:org.opensaml.xml. validate . validationexception:签名没有根据凭证的密钥进行验证
在org.opensaml.xml.signature.SignatureValidator.validate(SignatureValidator.java:78) ~[xmltool-1.3.2 .jar:na]
在org.artifactory.addon.sso. samlutils . verifysamlloginresponse (SamlUtils.java:394) ~
…66个常用框架省略
