Azure AD SAML使用通用证书而非应用专属证书的配置咨询

问题结论 #

你观测到的使用Azure AD通用证书签名断言的行为，是旧版迁移库应用搭配WS-FED协议、Azure AD应用代理预身份验证场景下的内置默认逻辑，普通自定义SAML应用无法通过手动配置触发该行为。

具体说明 #

• 你观测到的两个应用标签为Azure AD内置的迁移应用标记：8adf8e6e-67b2-4cf2-a259-e3dc5476c621是官方库应用的固定标识，WindowsAzureActiveDirectoryGalleryApplicationNonPrimaryV1是旧版非主版本库应用的专属标记。这类应用均为早期从ADFS环境同步迁移到Azure AD时自动生成的遗留应用，手动新建的自定义SAML/WS-FED应用无法获取该类标签。
• 通用证书签名的触发逻辑为Azure AD后台内置规则，没有公开的配置入口：只要应用属于上述ADFS迁移生成的WS-FED库应用，且配置了开启Azure AD预身份验证的应用代理，Azure AD就会默认使用租户级通用签名证书对断言签名，不会为该应用生成专属签名证书。
• 若要复现该配置，仅能通过将现有ADFS环境中的WS-FED应用迁移到Azure AD的方式实现：迁移完成后生成的应用会自动携带对应标签，且默认触发通用证书签名逻辑，手动新建应用无法实现相同效果。

断言示例验证 #

你给出的断言中X509证书的CN为accounts.accesscontrol.windows.net，确实是Azure AD全局通用的签名证书，和上述场景匹配。

<samlp:Response ID="RESPONSEID_REPLACED" Version="2.0" IssueInstant="2021-10-11T17:47:30.259Z" Destination="https://127.0.0.1:444/applications/default.aspx" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">https://sts.windows.net/TENANT-ID-REPLACED/</Issuer>
    <samlp:Status>
        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </samlp:Status>
    <Assertion ID="ASSERTION_ID" IssueInstant="2021-10-11T17:47:30.243Z" Version="2.0" xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
        <Issuer>https://sts.windows.net/TENANT-ID-REPLACED/</Issuer>
        <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
            <SignedInfo>
                <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
                <Reference URI="#REFERENCE_URI_GUID_REPLACED">
                    <Transforms>
                        <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                        <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    </Transforms>
                    <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                    <DigestValue>Zvoq+VZQsM+eW9HzHcYSJQvSm7L6E5urRYKQehkJf7w=</DigestValue>
                </Reference>
            </SignedInfo>
            <SignatureValue>LONG_SIGNATURE_REPLACED</SignatureValue>
            <KeyInfo>
                <X509Data>
                    <X509Certificate>MIIDBTCCAe2gAwIBAgIQWPB1ofOpA7FFlOBk5iPaNTANBgkqhkiG9w0BAQsFADAtMSswKQYDVQQDEyJhY2NvdW50cy5hY2Nlc3Njb250cm9sLndpbmRvd3MubmV0MB4XDTIxMDIwNzE3MDAzOVoXDTI2MDIwNjE3MDAzOVowLTErMCkGA1UEAxMiYWNjb3VudHMuYWNjZXNzY29udHJvbC53aW5kb3MubmV0DCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALH7FzF1rjvnZ4i2iBC2tz8qs/WP61n3/wFawgJxUnTx2vP/z5pG7f8qvumd7taOII0aSlp648SIfMw59WdUUtup5CnDYOcX1sUdivAj20m2PIDK6f+KWZ+7YKxJqCzJMH4GGlQvuDIhRKNT9oHfZgnYCCAmjXmJBtWyD052qqrkzOSn0/e9TKbjlTnTNcrIno3XDQ7xG+79vOD2GZMNopsKogWNxUdLFRu44ClKLRb4Xe00eVrANtBkv+mSJFFJS1Gxv611hpdGI2S0v1H+KvB26O7vuzGhZ/AevRemGhXQ5V5vwNEqXnVRVkBRszLKeN/+rxM436xQyVQGJMG+sVECAwEAAaMhMB8wHQYDVR0OBBYEFLlRBSxxgmNPObCFrl+hSsbcvRkcMA0GCSqGSIb3DQEBCwUAA4IBAQB+UQFTNs6BUY3AIGkS2ZRuZgJsNEr/ZEM4aCs2domd2Oqj7+5iWsnPh5CugFnI4nd+ZLgKVHSD6acQ27we+eNY6gxfpQCY1fiN/uKOOsA0If8IbPdBEhtPerRgPJFXLHaYVqD8UYDo5KNCcoB4Kh8nvCWRGPUUHPRqp7AnAcVrcbiXA/bmMCnFWuNNahcaAKiJTxYlKDaDIiPN35yECYbDj0PBWJUxobrvj5I275jbikkp8QSLYnSU/v7dMDUbxSLfZ7zsTuaF2Qx+L62PsYTwLzIFX3M8EMSQ6h68TupFTi5n0M2yIXQgoRoNEDWNJZ/aZMY/gqT02GQGBWrh+/vJ</X509Certificate>
                </X509Data>
            </KeyInfo>
        </Signature>

内容的提问来源于stack exchange，提问作者Zerqent