c# - 如何使用XPATH解析具有 namespace 的以下内容？

我需要从SAML令牌中提取声明。我感兴趣的声明是http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider，在这种情况下，我想获取值“ Google”。

我在以下代码中做错了什么？我已经对令牌响应进行了一些编辑，但还没有正确完成

码：

    string strExpression = "//t:RequestSecurityTokenResponse/" +
            "t:RequestedSecurityToken/"+
            ""+"Assertion/AttributeStatement/Attribute";

        XmlDocument xmlDocument = new XmlDocument();
        xmlDocument.Load(@"claim.xml");
        XmlNode rootNode = xmlDocument.DocumentElement;

        string ssNamespacePrefix = "t";
        string ssNamespaceURI = rootNode.GetNamespaceOfPrefix(ssNamespacePrefix);

        XPathNavigator xpathNav = xmlDocument.CreateNavigator();

        XmlNamespaceManager namespaceManager = new XmlNamespaceManager(xmlDocument.NameTable);
        namespaceManager.AddNamespace(ssNamespacePrefix, ssNamespaceURI);

        XPathNodeIterator itr = xpathNav.Select(strExpression, namespaceManager);

数据：

<t:RequestSecurityTokenResponse Context="http://localhost:2600/" xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust">
    <t:Lifetime>
        <wsu:Created xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2011-11-09T01:56:10.759Z</wsu:Created>
        <wsu:Expires xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2011-11-09T02:06:10.759Z</wsu:Expires>
    </t:Lifetime>
    <wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
        <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
            <Address>urn:federatasdf600</Address>
        </EndpointReference>
    </wsp:AppliesTo>
    <t:RequestedSecurityToken>
        <Assertion ID="_d70a5dasdfb868" IssueInstant="2011-11-09T01:56:10.775Z" Version="2.0" xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
            <Issuer>https://tlsadmin.accesscontrol.windows.net/</Issuer>
            <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <ds:SignedInfo>
                    <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                    <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
                    <ds:Reference URI="#_d70aasdf868">
                        <ds:Transforms>
                            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
                            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                        </ds:Transforms>
                        <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
                        <ds:DigestValue>4WLBasdfouzBQ=</ds:DigestValue>
                    </ds:Reference>
                </ds:SignedInfo>
                <ds:SignatureValue>TiDaasfg5iA==</ds:SignatureValue>
                <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
                    <X509Data>
                        <X509Certificate>MIIDEasdfasdfasdfasdfasdfasdfzg==</X509Certificate>
                    </X509Data>
                </KeyInfo>
            </ds:Signature>
            <Subject>
                <NameID>https://www.google.com/accounts/o8/id?id=AItasdffMAm4</NameID>
                <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer" />
            </Subject>
            <Conditions NotBefore="2011-11-09T01:56:10.759Z" NotOnOrAfter="2011-11-09T02:06:10.759Z">
                <AudienceRestriction>
                    <Audience>urn:federation:dev:rootwebDEV2600</Audience>
                </AudienceRestriction>
            </Conditions>
            <AttributeStatement>
                <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
                    <AttributeValue>[email protected]</AttributeValue>
                </Attribute>
                <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name">
                    <AttributeValue>Chris</AttributeValue>
                </Attribute>
                <Attribute Name="http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider">
                    <AttributeValue>Google</AttributeValue>
                </Attribute>
            </AttributeStatement>
        </Assertion>
    </t:RequestedSecurityToken>
    <t:RequestedAttachedReference>
        <SecurityTokenReference d3p1:TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0" xmlns:d3p1="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
            <KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID">_d70asdf1b868</KeyIdentifier>
        </SecurityTokenReference>
    </t:RequestedAttachedReference>
    <t:RequestedUnattachedReference>
        <SecurityTokenReference d3p1:TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0" xmlns:d3p1="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
            <KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID">_d70aasdfb868</KeyIdentifier>
        </SecurityTokenReference>
    </t:RequestedUnattachedReference>
    <t:TokenType>urn:oasis:names:tc:SAML:2.0:assertion</t:TokenType>
    <t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType>
    <t:KeyType>http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey</t:KeyType>
</t:RequestSecurityTokenResponse>

最佳答案

原因很简单：

Assertion元素位于默认（"urn:oasis:names:tc:SAML:2.0:assertion"）命名空间中。

Xpath认为未前缀的名称在“无名称空间”中，并且在消除提供的XPath表达式时：

//t:RequestSecurityTokenResponse
       /t:RequestedSecurityToken
          /Assertion
            /AttributeStatement/Attribute

找不到“没有名称空间”中的Assertion元素。

因此，根本没有选择任何元素。

解：


在XmlNamespaceManager上添加URL的附加前缀（例如“ x”）："urn:oasis:names:tc:SAML:2.0:assertion"
使用以下XPath表达式：


：

//t:RequestSecurityTokenResponse
       /t:RequestedSecurityToken
          /x:Assertion
            /x:AttributeStatement/x:Attribute

基于XSLT的验证：

<xsl:stylesheet version="1.0"
 xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
 xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust"
 xmlns:x="urn:oasis:names:tc:SAML:2.0:assertion">
 <xsl:output omit-xml-declaration="yes" indent="yes"/>

 <xsl:template match="/">
  <xsl:copy-of select=
  "//t:RequestSecurityTokenResponse
          /t:RequestedSecurityToken
               /x:Assertion
                   /x:AttributeStatement/x:Attribute "/>
 </xsl:template>
</xsl:stylesheet>

当此转换应用于提供的XML文档时：

<t:RequestSecurityTokenResponse Context="http://localhost:2600/" xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust">
    <t:Lifetime>
        <wsu:Created xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2011-11-09T01:56:10.759Z</wsu:Created>
        <wsu:Expires xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2011-11-09T02:06:10.759Z</wsu:Expires>
    </t:Lifetime>
    <wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
        <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
            <Address>urn:federatasdf600</Address>
        </EndpointReference>
    </wsp:AppliesTo>
    <t:RequestedSecurityToken>
        <Assertion ID="_d70a5dasdfb868" IssueInstant="2011-11-09T01:56:10.775Z" Version="2.0" xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
            <Issuer>https://tlsadmin.accesscontrol.windows.net/</Issuer>
            <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <ds:SignedInfo>
                    <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                    <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
                    <ds:Reference URI="#_d70aasdf868">
                        <ds:Transforms>
                            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
                            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                        </ds:Transforms>
                        <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
                        <ds:DigestValue>4WLBasdfouzBQ=</ds:DigestValue>
                    </ds:Reference>
                </ds:SignedInfo>
                <ds:SignatureValue>TiDaasfg5iA==</ds:SignatureValue>
                <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
                    <X509Data>
                        <X509Certificate>MIIDEasdfasdfasdfasdfasdfasdfzg==</X509Certificate>
                    </X509Data>
                </KeyInfo>
            </ds:Signature>
            <Subject>
                <NameID>https://www.google.com/accounts/o8/id?id=AItasdffMAm4</NameID>
                <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer" />
            </Subject>
            <Conditions NotBefore="2011-11-09T01:56:10.759Z" NotOnOrAfter="2011-11-09T02:06:10.759Z">
                <AudienceRestriction>
                    <Audience>urn:federation:dev:rootwebDEV2600</Audience>
                </AudienceRestriction>
            </Conditions>
            <AttributeStatement>
                <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
                    <AttributeValue>[email protected]</AttributeValue>
                </Attribute>
                <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name">
                    <AttributeValue>Chris</AttributeValue>
                </Attribute>
                <Attribute Name="http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider">
                    <AttributeValue>Google</AttributeValue>
                </Attribute>
            </AttributeStatement>
        </Assertion>
    </t:RequestedSecurityToken>
    <t:RequestedAttachedReference>
        <SecurityTokenReference d3p1:TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0" xmlns:d3p1="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
            <KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID">_d70asdf1b868</KeyIdentifier>
        </SecurityTokenReference>
    </t:RequestedAttachedReference>
    <t:RequestedUnattachedReference>
        <SecurityTokenReference d3p1:TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0" xmlns:d3p1="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
            <KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID">_d70aasdfb868</KeyIdentifier>
        </SecurityTokenReference>
    </t:RequestedUnattachedReference>
    <t:TokenType>urn:oasis:names:tc:SAML:2.0:assertion</t:TokenType>
    <t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType>
    <t:KeyType>http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey</t:KeyType>
</t:RequestSecurityTokenResponse>

选择所需的节点并将其复制到输出：

<Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust" Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">

   <AttributeValue>[email protected]</AttributeValue>

</Attribute>
<Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust" Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name">

   <AttributeValue>Chris</AttributeValue>

</Attribute>
<Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust" Name="http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider">

   <AttributeValue>Google</AttributeValue>

</Attribute>