首页 文章

由于IP和SP之间的时区差异，Spring Saml安全身份验证问题

提问于
浏览 次
1

Printed below is stack trace of auth failure issue caused due to time zone difference between IP and SP. Is there a way to configure this in spring security?

org.opensaml.common.SAMLException：响应发布时间太旧或未来日期，偏差60，时间2015-06-11T09：27：49.000Z at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.processAuthenticationResponse （webSSOProfileConsumerImpl.java:126）位于org.springframework上org.springframework.security.authenticate（SAMLAuthenticationProvider.java:82）org.springframework.security.authentication.ProviderManager.authenticate（ProviderManager.java:156）的org.springframework.security.saml.SAMLAuthenticationProvider.authenticate（SAMLAuthenticationProvider.java:82） . org.springframework.security.web.FilterChainProxy $ VirtualFilterChain.doFilter（org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter（AbstractAuthenticationProcessingFilter.java:195）中的security.saml.SAMLProcessingFilter.attemptAuthentication（SAMLProcessingFilter.java:84） FilterChainProxy.java:342）org.springframework.security.web.FilterChai的org.springframework.security.web.FilterChainProxy.doFilterInternal（FilterChainProxy.java:192） org.springframework.security.web.FilterChainProxy $ VirtualFilterChain.doFilter（FilterChainProxy.java:342）中的nProxy.doFilter（FilterChainProxy.java:166）

spring-saml saml-2.0

1 回答

  • 0

    您可以从spring-saml docs获取帮助来配置WebSSOProfileConsumerImpl bean以配置时间 .

    您可以尝试更新refreshToken元数据的时间

    <bean class="org.opensaml.saml2.metadata.provider.ResourceBackedMetadataProvider">
    <constructor-arg>
      <bean class="java.util.Timer"/>
    </constructor-arg>
    <constructor-arg>
        <bean class="org.opensaml.util.resource.ClasspathResource">
         <constructor-arg value="/metadata/idp.xml"/>
        </bean>
    </constructor-arg>
 <property name="parserPool" ref="parserPool"/>
 <property name="minRefreshDelay" value="120000"/>
 <property name="maxRefreshDelay" value="300000"/>
</bean>

    并尝试更新maxAuthenticationAge时间 .

    <bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl">
        <property name="maxAuthenticationAge" value="28800"/>
    </bean>
    回复于

相关问题