单点登录的SAML响应说明

• 本文为您介绍进行单点登录（SSO登录）时SAML响应中必须包含的元素，尤其是SAML断言中的元素。

• 合作方（IdP）判断用户的登录状态，若用户未登录，引导用户进行登录操作，登录之后合作方按SAML协议格式组织SAMLResponse返回报文，POST请求。

请求地址示例：https://www.ctyun.cn/sso/api/saml/acs

• SAMLResponse请求重定向到天翼云的地址为天翼云与合作伙伴约定的地址，亦可解析SAMLRequest请求报文后在报文AssertionConsumerServiceURL属性中获取天翼云接收请求地址，需要返回的SAMLResponse报文较为复杂，建议使用相应的类库进行生成

• SAMLResponse报文中saml2:Issuer相关的属性值必须与合作方提供给天翼云的IDP Metadata.xml中的entityID相对应。

• SAMLResponse报文中的公钥请与提供给天翼云的公钥一致

• SAMLResponse报文中必须必须有报文签名ds:Signature

• SAMLResponse报文中saml2:SubjectLocality的值必须服务提供商提供的SP Metadata的entityID一致。

• SAMLResponse报文中saml2:Subject中，必须有一个saml2:NameID，可配置为unspecified，可配置为动态的ctyunUserId，示例如下：

<saml2:Subject xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
  <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress" NameQualifier="https://www.ctyun.cn/sso/api/saml/1b8575039d02405fb0c54b923fc4c06c" SPNameQualifier="https://www.ctyun.cn/sso/api/saml/1b8575039d02405fb0c54b923fc4c06c">
      test@qq.com
  </saml2:NameID>
  <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
    <saml2:SubjectConfirmationData NotOnOrAfter="2025-10-10T22:37:52.930Z" Recipient="https://www.ctyun.cn/sso/api/saml/acs"/>
  </saml2:SubjectConfirmation>
</saml2:Subject>

• 合作方需要在SAMLResponse报文saml2:AttributeValue节点中需要提供给天翼云的属性

SAMLResponse xml示例（SAMLResponse解析后）：

<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://www.ctyun.cn/sso/api/saml/acs" ID="_17600926729300" IssueInstant="2025-10-10T10:35:52.930Z" Version="2.0">
  <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">saml-idp</saml2:Issuer>
  <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:SignedInfo>
      <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
      <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
      <ds:Reference URI="#_17600926729300">
        <ds:Transforms>
          <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
          <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
        </ds:Transforms>
        <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
        <ds:DigestValue>wwDGhJ6EBaAzNi07U3j0YRO9P+A=</ds:DigestValue>
      </ds:Reference>
    </ds:SignedInfo>
    <ds:SignatureValue>D1An0IhWwIMsnsXSNXKRDaWpkp</ds:SignatureValue>
    <ds:KeyInfo>
      <ds:X509Data>
        <ds:X509Certificate>MIID+zCCAuOgAwIBAgIBEjANBgkqhkiG9w0BAQ</ds:X509Certificate>
      </ds:X509Data>
    </ds:KeyInfo>
  </ds:Signature>
  <saml2p:Status xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
  </saml2p:Status>
  <saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_17600926729301" IssueInstant="2025-10-10T10:35:52.930Z" Version="2.0">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">saml-idp</saml2:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
      <ds:SignedInfo>
        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
        <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
        <ds:Reference URI="#_17600926729301">
          <ds:Transforms>
            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
          </ds:Transforms>
          <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
          <ds:DigestValue>yix4f787Vo2hEveX/hPHMSTexfI=</ds:DigestValue>
        </ds:Reference>
      </ds:SignedInfo>
      <ds:SignatureValue>gK6+gV/R9EMFxgellvRxeMaq94</ds:SignatureValue>
      <ds:KeyInfo>
        <ds:X509Data>
          <ds:X509Certificate>MIID+zCCAuOgAwIBAgIBEjANBgkqhkiG9w0BAQsFAD</ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </ds:Signature>
    <saml2:Subject xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
      <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress" NameQualifier="https://www.ctyun.cn/sso/api/saml/1b8575039d02405fb0c54b923fc4c06c" SPNameQualifier="https://www.ctyun.cn/sso/api/saml/1b8575039d02405fb0c54b923fc4c06c">test@qq.com</saml2:NameID>
      <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
        <saml2:SubjectConfirmationData NotOnOrAfter="2025-10-10T22:37:52.930Z" Recipient="https://www.ctyun.cn/sso/api/saml/acs"/>
      </saml2:SubjectConfirmation>
    </saml2:Subject>
    <saml2:Conditions NotBefore="2025-10-10T10:35:52.930Z" NotOnOrAfter="2025-10-10T22:37:52.930Z" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
      <saml2:AudienceRestriction><saml2:Audience>https://www.ctyun.cn/sso/api/saml/1b8575039d02405fb0c54b923fc4c06c</saml2:Audience>
      </saml2:AudienceRestriction>
    </saml2:Conditions>
    <saml2:AuthnStatement AuthnInstant="2025-10-10T10:35:52.930Z" SessionIndex="_1760092672930" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
      <saml2:SubjectLocality Address="https://www.ctyun.cn/sso/api/saml/1b8575039d02405fb0c54b923fc4c06c"/>
      <saml2:AuthnContext>
 <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
      </saml2:AuthnContext>
    </saml2:AuthnStatement>
    <saml2:AttributeStatement xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
      <saml2:Attribute Name="accountId" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml2:AttributeValue>1131432</saml2:AttributeValue>
      </saml2:Attribute>
      <saml2:Attribute Name="nickName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml2:AttributeValue>nickName</saml2:AttributeValue>
      </saml2:Attribute>
      <saml2:Attribute Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml2:AttributeValue>test@qq.com</saml2:AttributeValue>
      </saml2:Attribute>
    </saml2:AttributeStatement>
  </saml2:Assertion>
</saml2p:Response>

立即表单提交页面示例：

<!DOCTYPE html>
<html>
    <head>
        <meta charset="utf-8"/>
    </head>
    <body onload="document.forms[0].submit()">
        <noscript>
            <p>
                <strong>Note:</strong>
                Since your browser does not support JavaScript,
                you must press the Continue button once to proceed.
            </p>
        </noscript>
        <form action="https&#x3a;&#x2f;&#x2f;www.ctyun.cn&#x2f;federation&#x2f;saml&#x2f;acs" method="post">
            <div>
                <input type="hidden" name="SAMLResponse" value="PD94bWwgdmVyc2lv"/>
                <input type="hidden" name="RelayState" value="https://www.ctyun.cn"/>
            </div>
            <noscript>
                <div>
                    <input type="submit" value="Continue"/>
                </div>
            </noscript>
        </form>
    </body>
</html>

X509证书生成，参考使用openSSL生成

1、openssl genrsa -out server.key 2056
2、openssl req -new -x509 -days 3650 -key server.key -out server.crt -subj "/C=CN/ST=mykey/L=mykey/O=mykey/OU=mykey/CN=domain1/CN=domain2/CN=domain3"