Artifact Binding解析是否应支持Assertion元素级别的签名验证？

云上老周

2026-7-23

问题：Artifact Binding下无法验证Assertion级别签名的SAML2响应

问题详情

采用Artifact Binding的IDP返回的ArtifactResponse仅对Assertion元素级别进行签名，而非整个ArtifactResponse文档
这种签名方式在其他SAML绑定中是被支持的，但Artifact Binding目前不支持该场景
技术原因：Saml2ArtifactResponse类未像Saml2AuthnResponse类那样重写GetAssertionElement()方法，默认返回NULL
后续执行ValidateXmlSignature()方法时，因检测到空断言对象，只会验证文档级别的签名，导致Assertion的签名无法被正确校验

解决方案

通过给Saml2ArtifactResponse类添加以下从Saml2AuthnResponse复制的代码，使其能够正确定位Assertion元素，让签名校验逻辑可以验证Assertion级别的签名：

XmlElement assertionElementCache = null;
protected override XmlElement GetAssertionElement()
{
    if (assertionElementCache == null)
    {
#if NETFULL || NETSTANDARD || NETCORE || NET50 || NET60
        assertionElementCache = GetAssertionElementReference().ToXmlDocument().DocumentElement;
#else
        assertionElementCache = GetAssertionElementReference();
#endif
    }
    return assertionElementCache;
}

private XmlElement GetAssertionElementReference()
{
    var assertionElements = XmlDocument.DocumentElement.SelectNodes($"//*[local-name()='{Schemas.Saml2Constants.Message.Assertion}']");
    if (assertionElements.Count != 1)
    {
        throw new Saml2RequestException("There is not exactly one Assertion element. Maybe the response is encrypted (set the Saml2Configuration.DecryptionCertificate).");
    }
    return assertionElements[0] as XmlElement;
}