引起：sun.security.validator.ValidatorException：PKIX路徑構建失敗

Question

感謝弗拉基米爾。已經列入我的第二個ADFS配置，並試圖訪問元數據頁面下的相同後，我得到了在應用程序服務器控制檯以下異常：

Error retrieving metadata from //<adfs_server2>/FederationMetadata/2007-06/FederationMetadata.xml 
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.Su 
nCertPathBuilderException: unable to find valid certification path to requested target 
     at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) 
     at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1917) 
     at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:301) 
     at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:295) 
     at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1369) 
     at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:156) 
     at sun.security.ssl.Handshaker.processLoop(Handshaker.java:925) 
     at sun.security.ssl.Handshaker.process_record(Handshaker.java:860) 
     at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1043) 
     at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1343) 
     at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:728) 
     at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123) 
     at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82) 
     at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140) 
     at org.apache.commons.httpclient.HttpConnection.flushRequestOutputStream(HttpConnection.java:828) 
     at org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase.java:2116) 
     at org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java:1096) 
     at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:398) 
     at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:171) 
     at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397) 
     at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:323) 
     at org.opensaml.saml2.metadata.provider.HTTPMetadataProvider.fetchMetadata(HTTPMetadataProvider.java:250) 
     at org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.refresh(AbstractReloadingMetadataProvider.java:255) 
     at org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.doInitialization(AbstractReloadingMetadataProvider.java:23 
6) 
     at org.opensaml.saml2.metadata.provider.AbstractMetadataProvider.initialize(AbstractMetadataProvider.java:407) 
     at org.springframework.security.saml.metadata.ExtendedMetadataDelegate.initialize(ExtendedMetadataDelegate.java:167) 
     at org.springframework.security.saml.metadata.MetadataManager.initializeProvider(MetadataManager.java:398) 
     at org.springframework.security.saml.metadata.MetadataManager.refreshMetadata(MetadataManager.java:246) 
     at org.springframework.security.saml.metadata.CachingMetadataManager.refreshMetadata(CachingMetadataManager.java:86) 
     at org.springframework.security.saml.metadata.MetadataGeneratorFilter.processMetadataInitialization(MetadataGeneratorFilter.java:137 
) 
     at org.springframework.security.saml.metadata.MetadataGeneratorFilter.doFilter(MetadataGeneratorFilter.java:86) 
     at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) 
     at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192) 
     at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160) 
     at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346) 
     at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) 
     at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220) 
     at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122) 
     at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501) 
     at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171) 
     at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) 
     at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:950) 
     at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) 
     at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408) 
     at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1070) 
     at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611) 
     at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316) 
     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) 
     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) 
     at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) 
     at java.lang.Thread.run(Thread.java:745) 
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: 
unable to find valid certification path to requested target 
     at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387) 
     at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292) 
     at sun.security.validator.Validator.validate(Validator.java:260) 
     at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) 
     at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229) 
     at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124) 
     at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1351) 
     ... 48 more 
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
     at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:145) 
     at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:131) 
     at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280) 
     at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382) 
     ... 54 more 
- Next refresh cycle for metadata provider '//<adfs_server2>/FederationMetadata/2007-06/FederationMetadata.xml' will occur on 
'2014-09-23T11:58:38.338Z' ('2014-09-23T07:58:38.338-04:00' local time) 
- Metadata provider failed to properly initialize, fail-fast=true, halting 
org.opensaml.saml2.metadata.provider.MetadataProviderException: org.opensaml.saml2.metadata.provider.MetadataProviderException: Error retrie 
ving metadata from //<adfs_server2>/FederationMetadata/2007-06/FederationMetadata.xml 
     at org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.refresh(AbstractReloadingMetadataProvider.java:267) 
     at org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.doInitialization(AbstractReloadingMetadataProvider.java:23 
6) 
     at org.opensaml.saml2.metadata.provider.AbstractMetadataProvider.initialize(AbstractMetadataProvider.java:407) 
     at org.springframework.security.saml.metadata.ExtendedMetadataDelegate.initialize(ExtendedMetadataDelegate.java:167) 
     at org.springframework.security.saml.metadata.MetadataManager.initializeProvider(MetadataManager.java:398) 
     at org.springframework.security.saml.metadata.MetadataManager.refreshMetadata(MetadataManager.java:246) 
     at org.springframework.security.saml.metadata.CachingMetadataManager.refreshMetadata(CachingMetadataManager.java:86) 
     at org.springframework.security.saml.metadata.MetadataGeneratorFilter.processMetadataInitialization(MetadataGeneratorFilter.java:137 
) 
     at org.springframework.security.saml.metadata.MetadataGeneratorFilter.doFilter(MetadataGeneratorFilter.java:86) 
     at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) 
     at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192) 
     at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160) 
     at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346) 
     at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) 
     at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220) 
     at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122) 
     at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501) 
     at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171) 
     at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) 
     at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:950) 
     at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) 
     at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408) 
     at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1070) 
     at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611) 
     at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316) 
     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) 
     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) 
     at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) 
     at java.lang.Thread.run(Thread.java:745) 
Caused by: org.opensaml.saml2.metadata.provider.MetadataProviderException: Error retrieving metadata from //<adfs_server2>/Fed 
erationMetadata/2007-06/FederationMetadata.xml 
     at org.opensaml.saml2.metadata.provider.HTTPMetadataProvider.fetchMetadata(HTTPMetadataProvider.java:274) 
     at org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.refresh(AbstractReloadingMetadataProvider.java:255) 
     ... 30 more 
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider. 
certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
     at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) 
     at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1917) 
     at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:301) 
     at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:295) 
     at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1369) 
     at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:156) 
     at sun.security.ssl.Handshaker.processLoop(Handshaker.java:925) 
     at sun.security.ssl.Handshaker.process_record(Handshaker.java:860) 
     at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1043) 
     at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1343) 
     at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:728) 
     at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123) 
     at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82) 
     at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140) 
     at org.apache.commons.httpclient.HttpConnection.flushRequestOutputStream(HttpConnection.java:828) 
     at org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase.java:2116) 
     at org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java:1096) 
     at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:398) 
     at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:171) 
     at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397) 
     at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:323) 
     at org.opensaml.saml2.metadata.provider.HTTPMetadataProvider.fetchMetadata(HTTPMetadataProvider.java:250) 
     ... 31 more 
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: 
unable to find valid certification path to requested target 
     at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387) 
     at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292) 
     at sun.security.validator.Validator.validate(Validator.java:260) 
     at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) 
     at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229) 
     at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124) 
     at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1351) 
     ... 48 more 
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target.... 

我在classpath中添加相應的FederatedMetadata.xml文件以及。

我在securityContext.xml文件配置是這樣的：

<bean id="metadata" class="org.springframework.security.saml.metadata.CachingMetadataManager"> 
<constructor-arg> 
<list> 
<bean class="org.springframework.security.saml.metadata.ExtendedMetadataDelegate"> 
<constructor-arg> 
<bean class="org.opensaml.saml2.metadata.provider.FilesystemMetadataProvider"> 
<constructor-arg> 
<value type="java.io.File">classpath:metadata/services/FederationMetadata.xml</value> 
</constructor-arg> 
<property name="parserPool" ref="parserPool"/> 
</bean> 
</constructor-arg> 
<constructor-arg> 
<bean class="org.springframework.security.saml.metadata.ExtendedMetadata"> 
</bean> 
</constructor-arg> 
</bean> 
<bean class="org.opensaml.saml2.metadata.provider.HTTPMetadataProvider"> 
<!-- URL containing the metadata --> 
<constructor-arg> 
<value type="java.lang.String">://<adfs_server1>/FederationMetadata/2007-06/FederationMetadata.xml</value> 
</constructor-arg> 
<!-- Timeout for metadata loading in ms --> 
<constructor-arg> 
<value type="int">5000</value> 
</constructor-arg> 
<property name="parserPool" ref="parserPool"/> 
</bean> 
<bean class="org.springframework.security.saml.metadata.ExtendedMetadataDelegate"> 
<constructor-arg> 
<bean class="org.opensaml.saml2.metadata.provider.FilesystemMetadataProvider"> 
<constructor-arg> 
<value type="java.io.File">classpath:metadata/capital/FederationMetadata.xml</value> 
</constructor-arg> 
<property name="parserPool" ref="parserPool"/> 
</bean> 
</constructor-arg> 
<constructor-arg> 
<bean class="org.springframework.security.saml.metadata.ExtendedMetadata"> 
</bean> 
</constructor-arg> 
</bean> 
<bean class="org.opensaml.saml2.metadata.provider.HTTPMetadataProvider"> 
<!-- URL containing the metadata --> 
<constructor-arg> 
<value type="java.lang.String">://<adfs_server2>/FederationMetadata/2007-06/FederationMetadata.xml</value> 
</constructor-arg> 
<!-- Timeout for metadata loading in ms --> 
<constructor-arg> 
<value type="int">5000</value> 
</constructor-arg> 
<property name="parserPool" ref="parserPool"/> 
</bean> 
</list> 
</constructor-arg> 
</bean> 

請指點

Answer 1

您的系統抱怨說，它是無法覈實你的ADFS的HTTPS端點提供的證書。你可以找到關於如何在Spring SAML manual配置這樣的端點信任的詳細信息，請參見章7.2，使用SSL部分基於HTTP的元數據提供商，它說：

By default, loading of metadata using the HTTP-based provider over HTTPS performs trust verification configured in your JDK. In case you'd like to use certificates in your keyStore, add the following bean which changes the socketFactory used by the HTTP Client:

<bean class="org.springframework.security.saml.trust.httpclient.TLSProtocolConfigurer"/> 

The TLSProtocolConfigurer instantiates TLSProtocolSocketFactory and registers is as a default socket factory for https protocol inside the HTTP Client used for metadata loading. The socket factory uses all public certificates present in the keyStore as trust anchors for PKIX validation. The used keys can be constrained with property trustedKeys.

所以你應該使用的ADFS成簡單的導入證書你的samlKeystore.jks並配置上面提到的bean。有關提取證書和導入證書的詳細信息可以在手冊中找到。