.NET Core 6调用SAML IDP遇400错误（strict-origin-when-cross-origin）

我尝试使用StubIDP作为SAML身份提供商完成认证，项目采用AspNetSaml NuGet包。已经花费数小时排查仍未找到问题，希望有人帮忙找出疏漏。

返回的错误信息： #

Status 400
Bad Request
Version HTTP/2
Transferred 5.16 kB (0 B size)
Referrer Policy strict-origin-when-cross-origin

Program.cs配置： #

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddCors(options =>
{
    options.AddPolicy("Policy1",
        policy =>
        {
            policy.WithOrigins("https://stubidp.sustainsys.com/");
        });
});

Login.cshtml.cs代码： #

using MainApp.Models;
using Saml;

namespace MainApp.Pages.Account;

[AllowAnonymous]
public class LoginModel : PageModel
{
    public IActionResult OnGet()
    {
        var context = HttpContext;
        var samlEndpoint = "https://stubidp.sustainsys.com/e64887c8-c492-49e3-94d5-08d4471ee265/";

        var request = new AuthRequest(
            "https://localhost:11123", //TODO: put your app's "entity ID" here
            "https://localhost:11123/Account/Consume" //TODO: put Assertion Consumer URL (where the provider should redirect users after authenticating)
        );

        //now send the user to the SAML provider
        return Redirect(request.GetRedirectUrl(samlEndpoint));
    }
}

处理IDP返回POST请求的ConsumeModel代码： #

using MainApp.Models;
using Microsoft.AspNetCore.Cors;
using Saml;

namespace MainApp.Pages.Account;

[AllowAnonymous]
public class ConsumeModel : PageModel
{
    private readonly IUserManager _userManager;
    //private readonly IRoleRepository _roleRepo;
    private readonly ILogger<LoginModel> _logger;

    public ConsumeModel(IUserManager userManager, ILogger<LoginModel> logger)
    {
        _userManager = userManager;
        _logger = logger;
    }

    public void OnGet(string SAMLart)
    {
    }

    [EnableCors("Policy1")]
    public void OnPost()
    {
        // 1. TODO: specify the certificate that your SAML provider gave you
        string samlCertificate = @"-----BEGIN CERTIFICATE-----";
MIICFTCCAYKgAwIBAgIQzfcJCkM1YahDtRGYsLphrDAJBgUrDgMCHQUAMCExHzAd
BgNVBAMTFnN0dWJpZHAuc3VzdGF etc...
-----END CERTIFICATE-----";

        // 2. Let's read the data - SAML providers usually POST it into the "SAMLResponse" var
        Saml.Response samlResponse = new Response(samlCertificate, Request.Form["SAMLResponse"]);

        // 3. We're done!

        var username = "";

        if (samlResponse.IsValid())
            username = samlResponse.GetNameID();

IDP的SAML请求数据： #

内容的提问来源于stack exchange，提问作者Robb Sadler