OpenAM：處理AuthnRequest時出錯。空

Question

當試圖通過OpenAM給init的SSO，我得到以下錯誤：

HTTP Status 400 - Error processing AuthnRequest. null 
The request sent by the client was syntactically incorrect (Error processing AuthnRequest. null). 

日誌鏈接到的方法AMKeyProvider.getPrivateKey，（空指針異常），所以我知道私鑰無法讀取。 但是，我是OpenAM/SAML的新手，不知道在哪裏/如何解決此問題。

下面是完整的堆棧跟蹤：

libSAML2:10/17/2014 12:06:41:247 PM CEST: Thread[http-bio-8443-exec-8,5,main] 
ERROR: Error processing Request 
java.lang.NullPointerException 
    at org.forgerock.openam.utils.AMKeyProvider.getPrivateKey(AMKeyProvider.java:269) 
    at com.sun.identity.saml.xmlsig.JKSKeyProvider.getPrivateKey(JKSKeyProvider.java:112) 
    at com.sun.identity.saml2.profile.SPSSOFederate.signQueryString(SPSSOFederate.java:1125) 
    at com.sun.identity.saml2.profile.SPSSOFederate.initiateAuthnRequest(SPSSOFederate.java:346) 
    at com.sun.identity.saml2.profile.SPSSOFederate.initiateAuthnRequest(SPSSOFederate.java:146) 
    at org.apache.jsp.saml2.jsp.spSSOInit_jsp._jspService(spSSOInit_jsp.java:149) 
    at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) 
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:722) 
    at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:432) 
    at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:390) 
    at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:334) 
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:722) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210) 
    at org.forgerock.openam.validation.ResponseValidationFilter.doFilter(ResponseValidationFilter.java:44) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210) 
    at com.sun.identity.setup.AMSetupFilter.doFilter(AMSetupFilter.java:98) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210) 
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:225) 
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123) 
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472) 
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168) 
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98) 
    at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927) 
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118) 
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407) 
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1002) 
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:579) 
    at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310) 
    at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) 
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) 
    at java.lang.Thread.run(Unknown Source) 

Answer 1

例外指向： org.forgerock.openam.utils.AMKeyProvider.getPrivateKey（AMKeyProvider.java:269）

方法getPrivateKey看起來像這樣：

public java.security.PrivateKey getPrivateKey (String certAlias) { 
    java.security.PrivateKey key = null; 
    try { 
     key = (PrivateKey) ks.getKey(certAlias, 
       privateKeyPass.toCharArray()); 
    } catch (KeyStoreException e) { 
     logger.error(e.getMessage()); 
    } catch (NoSuchAlgorithmException e) { 
     logger.error(e.getMessage()); 
    } catch (UnrecoverableKeyException e) { 
     logger.error(e.getMessage()); 
    } 
    return key; 

}

因此，在預期路徑上根本沒有密鑰存儲，在密鑰存儲中沒有包含相應別名的有效密鑰，或密鑰庫和/或密鑰密碼錯誤。

密鑰存儲路徑（以及路徑包含加密密碼文件）可以在openAM管理Web UI可以看出下配置 - 服務器和站點 - myServerName - 安全，通常：

%BASE_DIR%/%SERVER_URI%/keystore.jks 

，其中%BASE_DIR%下配置中配置 - 服務器和站點 - myServerName - 通用。

Answer 2

您可以檢查

http://docs.forgerock.org/en/openam/11.0.0/admin-guide/index.html#set-up-federation

有您必須配置特定的SAML密鑰庫。