SAML（Security Assert Mark Language）常用来实现SSO。
本文主要梳理一下SAML的代码逻辑
术语讲解：
IDP: Identity provider 在单点登陆中是指统一身份认证平台。
SP：Service Provider 在单点登陆中是指需要被认证的服务方。
Assert: 断言，是指IDP 认证用户后，发送认证结果给SP的一种形式。
实验场景： web程序testSp 是SP
web程序testIdp是IDP
用户通过浏览器访问SP服务中的某个资源（JSP页面），这时候SP会校验请求中是否有认证信息，如果没有，将会重定向页面到IDP的身份认证页面。然后IDP方认证成功后，会将认证结果以断言的形式发送给SP，然后SP方通过检验断言的签名以保证断言的有效性，最后将页面重新重定向到SP访问资源的页面。
具体场景
1.用户通过浏览器访问SP端的资源，如访问http://www.obito-sp.com:8080/testSp/index.jsp
代码中通过filter来拦截该请求，然后判断该请求中是否有认证信息。如果有认证信息，说明该用户已经认证通过的，直接放行，然后没有认证信息，则页面重定向。这里重定向不是简单的重定向，而是需要带上一个AuthnRequest参数到重定向的页面。其中AuthnReqeust如下
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="http://www.obito-sp.com:8080/testSp/assertConsumer"
Destination="http://www.obito-idp.com:8080/testIdp/ssologin"
ID="_a4984546052a64544d9761fbb4c24021" IssueInstant="2019-04-18T05:49:09.215Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Version="2.0">
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">Obito_SP</saml2:Issuer>
<saml2p:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:2.0:nameid-
format:transient"/>
<saml2p:RequestedAuthnContext Comparison="minimum">
<saml2:AuthnContextClassRef xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
urn:oasis:names:tc:SAML:2.0:ac:classes:Password
</saml2:AuthnContextClassRef>
</saml2p:RequestedAuthnContext>
</saml2p:AuthnRequest>其中 AssertionConsumerServiceURL是指IDP将断言发送给SP的地址。
Destination是指重定向的地址，IssueInstant是指生成AuthnRequst请求的时间。
ProtocolBinding是指IDP通过什么方式将断言发送给SP。 HTTP-Artifact是指IDP会发送一个artifact number给SP,然后SP会直接和IDP建立连接，而不是走浏览器继续重定向，然后IDP再把真正的断言发给SP。
2.用户访问资源的请求中没有带认证信息，会重定向到IDP,重定向的地址为http://www.obito-idp.com:8080/testIdp/ssologin
同时会将第一步中的AuthnRequest进行编码，以参数的形式附加到重定向的地址中。这里代码没有对AuthRequest的内容进行核查。只是代码以后需要改进的。
3.IDP这边进行身份认证，如果认证通过，会发送一个artifact number给SP,当然还是以重定向的方式，artifact number也是以参数的形式附加到重定向地址的后面，这里重定向的地址就是AssertionConsumerServiceURL的地址。
4.SP收到artifact后，会和SP重新建立连接，这里可以是通过SOAP 方式，然后发送一个 ArtifactResolve，具体格式如下：
<?xml version="1.0" encoding="UTF-8"?><saml2p:ArtifactResolve xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="http://www.obito-idp.com:8080/testIdp/artifactResolution" ID="_c0b46eb67d9ca146041085b85533a810" IssueInstant="2019-04-18T12:32:27.352Z" Version="2.0">
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">Obito_SP</saml2:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="#_c0b46eb67d9ca146041085b85533a810">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>/J7WshhksMlDoGLTxeY0kJZwDdGrsowJjH4oBrrGBWE=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
LpQW3elUlnNNWDq1dMgEIH1kDGHG7ZLXtuTyiHn4QaQKQW6hq7PzxNJRxCcA6oEQZ7oXdWW33fBR
SPV1uvbz+nurUbn0NFu3aPxqHME/xdSCw7/HByKGq3r2oxaSlIUKReaDv2/uJt9kzP3lrokAVxIb
0oWIri2oXtpKdZrUzZUPW468ptH5fT8kCeym/Iz2coIE6hIjav2wfSpGipxqeysolI7zCXQITJ39
suS8QVDqf4Dyqb1t7GicklHGp2RYCc+py0y9WC+RXFreXa5us3Z7yUdB6wCdCau7OTQzZuVZS8gy
PJwoqiPLnkT4tYTebHfoue1uzAW7zR5TbNutNA==
</ds:SignatureValue>
</ds:Signature>
<saml2p:Artifact>AAQAAMFbLinlXaCM+FIxiDwGOLAy2T71gbpO7ZhNzAgEANlB90ECfpNEVLg=</saml2p:Artifact>
</saml2p:ArtifactResolve>5.IDP收到ArtifactResolve后，会进行签名认证，认证通过后，会将真正的断言发送给SP，当前发送的断言也会进行加密和签名的。具体格式如下：
加密的形式
<?xml version="1.0" encoding="UTF-8"?><saml2p:ArtifactResponse xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="http://www.obito-sp.com:8080/testSp/assertConsumer" ID="_57be1dfd2390140014252d63fbe7e53e" IssueInstant="2019-04-18T12:32:51.902Z" Version="2.0">
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">Obito_IDP</saml2:Issuer>
<saml2p:Status>
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
</saml2p:Status>
<saml2p:Response Destination="http://www.obito-sp.com:8080/testSp/assertConsumer" ID="_4d5434a7332712508a285a50d3e2b867" IssueInstant="2019-04-18T12:32:51.933Z" Version="2.0">
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">Obito_IDP</saml2:Issuer>
<saml2p:Status>
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
</saml2p:Status>
<saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Id="_67b20d63719babf2541fb26826fa85f1" Type="http://www.w3.org/2001/04/xmlenc#Element">
<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<xenc:EncryptedKey Id="_cba2ee6d6b6a09dcade545e4e99b50a6">
<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
</xenc:EncryptionMethod>
<xenc:CipherData>
<xenc:CipherValue>ipefLOccEjX+uoi4t6MtJjNOiDpIkop/ISD5YSQ8JM9+cyJu8IpZ83CxMHIIddJ1729jLf7NPtGsQgElXrrG1KRvWn6M0X1jrf5NYdnpFtakX02JhYL9I8sfuEMUevvS6TKqSJLRXzUTkAu/cpjSjAPzVUtA+3fi+5tT940vi6vLxVuRZEtLiMRm8vMb5r9wSIlY4LhMJR1CYMX19IMJHUEdJLLed3r8uvO1u+jGXf6IdHajfJAo7hFL5k5xYGn0K11uJNSpzjbnkfMzRhTg9EK4iMs0bnwvmEebA+TUnrh8o5IvPFzypBSUt8lTdoz2S7tOmSVCaeaB2v1ov8zZBw==</xenc:CipherValue>
</xenc:CipherData>
</xenc:EncryptedKey>
</ds:KeyInfo>
<xenc:CipherData>
<xenc:CipherValue>qWmrjm5cm8R6pqVEryBlmmTFR7NTsn8J3sMHNy/W8Tvr5gnow/Zg+VK7qA7l2Pu8LIvQ6Jtj8XWLC3VMWCSzEZ4wkqsjd+voiET1bWiOdZP/LYSLHsunByRZlEVrUdZgqa/TyF5CNbvRYK+24dEV+nZInPlFm0V58DhvcQFy16whHahbYCWgLrK2CBHkAYn06FNYK4tjW59vWXXfrmB8GYiV0hXxUStLcEcT/YyUHOuifxN4ELPlNHNSMvqXwLcI62RTe/w43fViaYOMrz5j4CP8N2+a1gtwZvJFSVcW+qzVj2ui8r1H1ZWQqdLaekTIXPp7xEhHy3rLhzJVnS85XsZXDfQh/Z/wae47TaYirJGFjzPRlDMjiNg4xA7txww8iBDNrqcQgr2gr/bDZvi5fJxIStLRdtr26apnwalCogT8T2Trw6q5kanGZ7fQqo+qousaaBQiPhMgzOCnnwX4/3788U633g+hOnvtYXe/H0TB/NW+nbfWcJBnkVOef6oiNUUhbREdJ/bQvHWzpy2psOAA0dpR1jvGoypQ8S8HzRcT5dJPBaiVlwQOV9mOG/Nqos921l2e8U4g/6Xs37IxW5+any37Myaqcc3yfKIs9DuN7E/9OCmCimyDsaou513R9KoH6x5kvvLBJt/ZXv1P6V8f6Q8bswbxOVK/S4I4HREWt4ROnpcXhEGlKrwDTxZr3VlFeftNFlNIEYVHsugJGDTmZOt6T8ka6b2uhPYlaPWEZ2bwsHCsKhLZK53gIq5k8zarXcxyrtyFckZnua/PEFBNFS5uSxVIrx2n+SeREplHb2OuMAd+oXq+cbVOUAVUB316xktMbEI4WiCJNfic8v7uNhy4JL1lGGhXZ0Xn8Tvt2y1Wv/iiRom1INXCH+xd9pq1OJKfegAhALlWlscoFzGfjuc1Z4UuUWYDOT4NgChWWSvvqpmllJeKoQYzllwnPaKGI/ndBrqcWX3l9Uv/DfGZB5mAqY+Z+2PfSxhwOm1FgY5wS6H5ugrfL48HskY4J/HHcWjeNmffeKf+/z9BN5d+46IxGI+V+w5l/H5LPITLdidn53lVes0UG7Cy0LQ1WhjOzk1afYlgR1pYGI9YT4S4fqBYQK3d/viGOq6jwboNDVWSRg46CttMaFTheRKRXFjH4wWLhZwWhISQPe/ywSoNje4NbDBQOZATcBSIYOMoPCWfpKujCJdCvz3YfzzXYrOkwV4upDxNJknosdFFXha2hxLsZob+5QFMXgWVtspgWFteAAS4ciNjmYBlFBxV7uin9H8aEfGRhQkf51NJdkubj3T0KHmNzJtTArrgHD4dy5hCEuBDE5FcisTt0bWmer4GzNzml4MKvScVC365r+/XUaWfE7tN3F8xZKo4gYxg7NzoWqmp5yIJxHnjcsgzeOT1FjYqzbsprkNlxOM/juLxGval0KRsayRorP0dwuK3t7hWAvRXeVK6RcA4q71WT6nGdshPm9xlVjnRNhFV10ur0lQ86tCDIIEoL6w2IJT4+UT81L597b9vNj8seW+7oSdbLl201u/79jTW7wRPA7wS3t0wNNG6UuGZwsgY2xWvuh0J4hqlfyPIfTGJy5LbGZZUl6XYu/bouXq0XBElLnkvXNpMlWTcJCeihJ0EeUAhU9djg42/hKORsii18oVrg5V3hL8JCbp7ASnFRAp1e5vqpYKu3LR6yAKoQkrJYT9mOBkOEXhtn+KSUaYyiMQhDJT2irzBcNSlBdYWA/WhvxKlig3YoIBmgHstjfqvwESsZgV2QztP86BdqVoQpfu+RRDZT1nMlh5sfJXIJ8PmH/DYnuRV8IbG16exWrYroza8LFru/qM450idkojp12F1puHVRmcKVrv26Y2UtgJDTFKWqeM1OA8dCe1uVADClmeYbRsgxCvc6m5OtoPPk+7p8YaRGWvoEvP7D4TmClYP2W4jm78t5EDgewpCWaoC77lMo4MBCu5ayvT0uQz4M7Iqd+pwhTFpjhl+4bClzra2eJb7Q0HhgTsF9WtAw9i1Th+YSANErhltJD0JyreHCyAEDxVwruPH9n6HeTyZVlRonwlUzmHsBpFJSs0ojXvs1Yzvc6gki1xB7F/4645i4DZxpbvlh7Iogf2jEYyXM7FsokHWnp+knWJ20xjQtWTuIjuk6ubiOzHGkqaPTlF+sjJDVWc2+foeyLur0+p5MnF//Ys20PYtnYB+UuYTbN6/z2HuG1DOc8WwyRCRgex96y8ocIrDDUngFrhTjySvmbY7SioHZ7K2VXPEarQQvM4Cl5EQTVV7DnY3UcTwgcQzk7+IRp2808WazciSMC9+/lvhHA4ojdUCeRcrlVvAGqUTYn/OtNeZ5P/KzuosFjYfXWDiFcHgzFmiVOPyW0RO/19CQ0dMyLHbN1TfcYaH5c9B+DtE+YiM6x3NmGWf9ZLuK3GvsFHyIHb65Ia2vhY+9v7apMZpYHd3/1/StBWed+Uvq/bmGZEWs2D+efnkPBd1eesTiw2zXWmDjToZC6V5mp/dW2P+77qCqSPmJYaCGE9BffBQhw4MzStNfDopAwf84NFJH/VQHeQbQdMaotoYUkd8ycyuMb03jpyoUYCSO5wbUiUfRHqPWylax8rv/PR4LYWd/NuYc/KKi3guhCNSVxIrBRTITzT2/fuLRuivQzrL7uebB3B+c8EU7CzCp1q/s0Y1oze0pUxjEvfCKCutBaccAC0YNj8aAvpUjOhUqz0D1SzoyXO5XbqxeD7z7kLSDfihF+ES4WeZy815zU1sj/lSybaIUHV0QwVSVKkHIFC4vHqJUPCAi7KFSteKamr4n04CjKvbfybnGZDbefA1fUosH0qYEBU1yhK+7exB/L+rQVSRdSLY6cI7cVvITUE2TUhMXdS+n4gLmd0usIUcRRPhFws8E0Ui8zDcWYoQH9KtH7NybyHKv+DlPsRbwmrm47OMOwoFCYja4gX68KH79og+mxiJBwOzwAaDM/1V83QNszHrOHLXy71jHWY70oCy6Dx5CDVK3oQMWPGfmJJwexPLgRkMoTSh4uNFiJxZeWTLF+ODO0OZqFgNAeb65e47VlifkXh6JrqmXrswnonSllSRymNOlIQYIl8y4BAKK/eFc+zVY3gr7l5cqYFgNEacH11zld+vq6u7FPFXVRghNfZwLZH6ZfNUodvVMotONqaQTnmWS+Juyk8u5UaQGLTRqGiHEcMYaK034TBvc1NXF2HzLi+dP/1q1Y7gJu5BgoJHuiouJTnrqjy8dvEMboAz5xoiwdJ973hpkxfsg8NcaZgAjWqh2nQs6e1e5T5Wm54FyHxp9S90iJU7Olze5tmCMzQR9OThhSYI/FmXd4cQ7yrkQosOA4OXwsIIFvyaIN25Fnk/pC+hMzwmeW5HfBX/W7X19t9wzbOnnIJbLPEM4V/5H9L9K2yv/pmL24sxUr2RwivMLY5OpL9wFUDXFO3SqqkPMZ48/WvdHoamzo4wrnB33nbyJrSo45lOMe7EhkNhb/pKFv08Y05g/H0qo6L1LxRLviub9DIRfmVsIUwXgUTAdGGoPTLRtr05bh52tuAXoDMt4HV6jK+gWnKdlHopxR7HdUVh127/YLcF0z7qq8WlXf1lLiDr1XzTuebXkfym0OKSKS4D5Bt9THZtCtad8lf4Lt168QUuqoOwupD993i/0pv9IBGs3kU1wJPt8tLfU12RK3KOMVXa3lObX6ttp8EVuZ6+dIc6oGAz2t/+9qvM7q7kypAr1dGUed6mtYCbd41LrCPrbhs5qu1RqrysJoGzrZLG6R6MK2mIEjTXf7GQKnkzl8sf1TbIHZzV6rHHw31gMg4dC/eNb2Ek5Qbb+FBiy4AYYAHNu1o3wYDCfPhS35b2Tw7WkrJbIzgPktRE+4nJhtfQn3lf8YdtyQso5WQPYTR+scDpp/makKyM9KQrXFKP/scEjN63bchh2Jrz1i8=</xenc:CipherValue>
</xenc:CipherData>
</xenc:EncryptedData>
</saml2:EncryptedAssertion>
</saml2p:Response>
</saml2p:ArtifactResponse>解密后断言的形式
<?xml version="1.0" encoding="UTF-8"?><saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsd="http://www.w3.org/2001/XMLSchema" ID="_d4e8e48ad6370bee9083f18b0d76348b" IssueInstant="2019-04-18T12:32:51.934Z" Version="2.0">
<saml2:Issuer>Obito_IDP</saml2:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#_d4e8e48ad6370bee9083f18b0d76348b">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="xsd"/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>z4lm06crUP0qlVvRnb2x2A7DKhL9HduxqWUICnsZv/E=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>E+TMPkFdgX67Sbfx3jBXq7Bol4AvnRYQDHoGhbn6F9EzGG0C5BaPqaumUDeuiA7v2I+wG600wnumTakLu6ZAsiDP0RMj/ZrOR2ZpFwTRRLKa4ITwX26q7HgIStxHEpl5vwmIMvB9O189/iemapPDsQlTNCwwE+kEXzgzYmx69MICJTVTAhU2zyLhvhFCTv2o+XrmraRsXGHd/asXluObJsovVEMg/Nw2soy8WIuxNvY8bCDVZ6RDoFzIfif2LH2FlmjKGemuLm4WdK5JhnyQOvDLuWD9RCPG2yB/kmkuB8xMnMftVL7RKVIt0uHCuDJGbcJ4rdD5WTlMxC9i/v/Csw==</ds:SignatureValue>
</ds:Signature>
<saml2:Subject>
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="Name qualifier" SPNameQualifier="SP name qualifier">Some NameID value</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData InResponseTo="Made up ID" NotBefore="2019-04-16T12:32:51.938Z" NotOnOrAfter="2019-04-20T12:32:51.938Z" Recipient="http://www.obito-sp.com:8080/testSp/assertConsumer"/>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2019-04-16T12:32:51.939Z" NotOnOrAfter="2019-04-20T12:32:51.939Z">
<saml2:AudienceRestriction>
<saml2:Audience>http://www.obito-sp.com:8080/testSp/assertConsumer</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AttributeStatement>
<saml2:Attribute Name="username">
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">bob</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="telephone">
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">999999999</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
<saml2:AuthnStatement AuthnInstant="2019-04-18T12:32:51.947Z">
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Smartcard</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
</saml2:Assertion>6.SP通过分析断言，可以获取到登陆用户的用户名等信息，然后为该用户创建session，然后将页面重定向到第一步，用户要访问资源的页面，这里同样会被filter拦截，但是当前请求已经包含了认证信息，即session中有对应的信息。然后会直接返回对应资源界面。
大体流程是这样，这篇写的可能比较匆忙，日后在闲暇的时候，再仔细分析一下加密和签名的过程。