第 7 課：SAML 用戶端和協定映射器

HTMLTAG_1019__HTMLTAG_1020___7。輕量級存取權杖___HTMLTAG_1021__HTMLTAG_1022

預設情況下，Keycloak 存取權杖包含許多聲明（realm_access、resource_access、電子郵件、名稱、preferred_username，...）。輕量級存取令牌透過僅保留基本聲明來減少令牌大小。

___HTMLTAG_1025__HTMLTAG_1026___7.1 為什麼我們需要輕量級存取權杖？ HTMLTAG_1027__HTMLTAG_1028

___HTMLTAG_1030__HTMLTAG_1031__HTMLTAG_1032___減少頻寬：較小的令牌 = 透過 HTTP 標頭傳送速度更快____HTMLTAG_1034__HTMLTAG_1035___ ___HTMLTAG_1036__HTMLTAG_1037__HTMLTAG_1038___減少敏感資訊_：存取權杖經常傳送到許多服務，不應包含太多 PII____HTMLTAG_1040__HTMLTAG_1041___ ___HTMLTAG_1042__HTMLTAG_1043__HTMLTAG_1044___安全改進：資源伺服器使用令牌自省在需要時取得完整聲明____HTMLTAG_1046__HTMLTAG_1047___

HTMLTAG_1049__HTMLTAG_1050___7.2 設定輕量級存取權杖____HTMLTAG_1051__HTMLTAG_1052

預設情況下，協定映射器具有選項 新增至輕量級存取權杖。使用：

___HTMLTAG_1058__HTMLTAG_1059___對於每個映射器，關閉 新增至存取權杖___HTMLTAG_1061_令牌中不需要的宣告中的輕量級___HTMLTAG_1062__HTMLTAG_1063___ ___HTMLTAG_1064__HTMLTAG_1065___使用客戶端策略（請參閱下一篇文章）為特定客戶端強制執行輕量級令牌____HTMLTAG_1066__HTMLTAG_1067___ ___HTMLTAG_1068__HTMLTAG_1069___資源伺服器呼叫令牌自省端點以取得完整聲明：___HTMLTAG_1070__HTMLTAG_1071___

# Token Introspection — lấy full claims
POST /realms/my-company/protocol/openid-connect/token/introspect
Content-Type: application/x-www-form-urlencoded

token=ACCESS_TOKEN&
client_id=my-resource-server&
client_secret=CLIENT_SECRET

# Response chứa full claims
{
  "active": true,
  "sub": "user-id",
  "email": "[email protected]",
  "realm_access": { "roles": ["admin", "user"] },
  "resource_access": { ... },
  ...
}

___HTMLTAG_1083__HTMLTAG_1084___成對主題識別碼為每個客戶端建立不同的sub — 防止跨服務使用者追蹤。

HTMLTAG_1089__HTMLTAG_1090___8.1 成對識別碼配置___HTMLTAG_1091__HTMLTAG_1092

___HTMLTAG_1094__HTMLTAG_1095___新增協定映射器類型 成對主體識別碼到客戶端或客戶端範圍___HTMLTAG_1098__HTMLTAG_1099___ ___HTMLTAG_1100__HTMLTAG_1101___設定：___HTMLTAG_1102__HTMLTAG_1103___

Mapper Type: Pairwise subject identifier
Name: pairwise-sub
Salt: random-salt-value-keep-secret   # Salt dùng để hash, PHẢI giữ bí mật
Pairwise Subject Identifier Algorithm: SHA-256
Sector Identifier URI: (tùy chọn)     # Nhóm clients share cùng sub

___HTMLTAG_1105__HTMLTAG_1106___結果：HTMLTAG_1107__HTMLTAG_1108

# Client A nhận sub:
{ "sub": "hashed-value-for-client-a" }

# Client B nhận sub khác:
{ "sub": "hashed-value-for-client-b" }

# Cùng 1 user nhưng sub khác nhau → không thể correlate

___HTMLTAG_1109__HTMLTAG_1110___磁區識別碼 URI：HTMLTAG_1111__HTMLTAG_1112

如果您希望一組用戶端共用相同的 sub（例如，相同服務的 Web 應用程式和行動應用程式），請使用 磁區識別碼 URI。此 URI 指向一個 JSON 數組，其中包含同一扇區中客戶端的重定向 URI：

預編碼_24

HTMLTAG_1119__HTMLTAG_1120___9。將 SAML 與 Spring Boot 整合___HTMLTAG_1121__HTMLTAG_1122

使用 spring-security-saml2-service-provider 整合 SAML SP：

預編碼_25

# application.yml
spring:
  security:
    saml2:
      relyingparty:
        registration:
          keycloak:
            entity-id: https://myapp.example.com/saml/metadata
            signing:
              credentials:
                - private-key-location: classpath:credentials/sp-private.pem
                  certificate-location: classpath:credentials/sp-certificate.pem
            assertingparty:
              metadata-uri: http://localhost:8080/realms/my-company/protocol/saml/descriptor

預編碼_27

HTMLTAG_1127__HTMLTAG_1128___10。練習___HTMLTAG_1129__HTMLTAG_1130

HTMLTAG_1131__HTMLTAG_1132___實驗 1：建立 SAML 用戶端並測試斷言___HTMLTAG_1133__HTMLTAG_1134

___HTMLTAG_1136__HTMLTAG_1137___使用實體 ID ___HTMLTAG_1138__URL_3___>___HTMLTAG_1139__HTMLTAG_1140___ 建立 SAML 用戶端 ___HTMLTAG_1141__HTMLTAG_1142___設定 ACS URL、簽署文件、簽署主張 = ON___HTMLTAG_1143__HTMLTAG_1144___ ___HTMLTAG_1145__HTMLTAG_1146___使用 samltool.com_ 或 SAML 追蹤器瀏覽器擴充功能來擷取 SAML 回應____HTMLTAG_1149__HTMLTAG_1150___ ___HTMLTAG_1151__HTMLTAG_1152___分析 SAML 斷言：NameID、AttributeStatement、條件、簽章___HTMLTAG_1153__HTMLTAG_1154___

HTMLTAG_1156__HTMLTAG_1157___實驗室 2：OIDC 協定映射器___HTMLTAG_1158__HTMLTAG_1159

___HTMLTAG_1161__HTMLTAG_1162___在使用者個人資料中建立使用者屬性 employee_id___HTMLTAG_1165__HTMLTAG_1166___ ___HTMLTAG_1167__HTMLTAG_1168___建立使用者屬性對應器：employee_id → 令牌聲明 emp_id___HTMLTAG_1172__174141172__141172__1415_ML ___HTMLTAG_1175__HTMLTAG_1176___建立群組成員映射器：群組 → 令牌宣告 群組___HTMLTAG_1178__HTMLTAG_1179__HTMLTAG_1180___ ___HTMLTAG_1181__HTMLTAG_1182___建立硬編碼宣告：env = staging___HTMLTAG_1186__HTMLTAG_1187188___ ___HTMLTAG_1189__HTMLTAG_1190___測試：在 jwt.io___HTMLTAG_1192__HTMLTAG_1193__HTMLTAG_1194___ 中取得令牌並驗證聲明