问WordPress单点登录使用SSP和ADFS作为IdP代理

EN

嗯，我被困在这上面好几天了，我唯一的希望也是如此。

我用ADFS3.0配置了Windows2012 r2，用SAML2.0在插件上配置了bitnami (4.2.2)，用SimpleSAMLphp 1.13配置了Ubuntu服务器。

Wordpress配置如下：

WordPress NameID策略：

​

WordPress属性：

​

对于身份验证源，我使用SSP的文件模块。它具有以下特点：

User-Name用于用户id，mail用于用户的电子邮件地址，Filter-Id用于用户组.

在ADFS方面，我已经将索赔提供程序信任配置为SSP，将依赖方信任配置为WP。

索赔规则为：

SSP:

规则1:转换名称id策略。如果没有设置此规则，WP的SSP将给出NameIDPolicy无效的错误。

c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] == "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"] => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType);

规则2:通过所有索赔

c:[Type == "https://example.com/simplesamlphp/saml2/idp/metadata.php"] => issue(claim = c);

WordPress:

规则1:将名称属性转换为WP属性

c:[Type == "User-Name"] => add(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Value = c.Value);

规则2:转换邮件属性

c:[Type == "mail"] => add(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/emailaddress", Value = c.Value);

规则3:转换组属性

c:[Type == "Filter-Id"] => add(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/Group", Value = c.Value);

规则4:转换为Givenname属性

c:[Type == "User-Name"] => add(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/givenname", Value = c.Value);

规则5:转换为姓氏属性

c:[Type == "User-Name"] => add(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/surname", Value = c.Value);

规则6:转换名称id策略&发出所有索赔

c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"] => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress");

用户获得认证罚款(SP/IdP启动)。但在WP方面，我说Username was not provided时出错了。

ADFS跟踪日志显示了我的SSO token is null or empty. Cannot write SSO token to Cookies.

我检查了IdP的用户登录，它显示了用户登录。跟踪日志还显示了Valid assertion returned from 'https://example.com/simplesamlphp/saml2/idp/metadata.php'

我想索赔规则有问题，但我不确定，因为配置看起来和工作正常。

任何指点都欢迎！

谢谢!