生成 <saml2:AuthnRequest>

如前所述，Spring Security 的 SAML 2.0 支持生成一个 <saml2:AuthnRequest> 来开始与断言方进行身份验证。

Spring Security 部分通过在过滤器链中注册 Saml2WebSsoAuthenticationRequestFilter 来实现这一点。默认情况下，此过滤器响应端点 /saml2/authenticate/{registrationId}。

例如，如果您部署到 rp.example.com，并且您为注册分配了 ID okta，则可以导航到

rp.example.org/saml2/authenticate/okta

结果将是一个重定向，其中包含一个包含已签名、压缩和编码的<saml2:AuthnRequest>的SAMLRequest参数。

更改<saml2:AuthnRequest>的存储方式

Saml2WebSsoAuthenticationRequestFilter使用Saml2AuthenticationRequestRepository在发送<saml2:AuthnRequest>到断言方之前持久化AbstractSaml2AuthenticationRequest实例。

此外，Saml2WebSsoAuthenticationFilter和Saml2AuthenticationTokenConverter使用Saml2AuthenticationRequestRepository加载任何AbstractSaml2AuthenticationRequest，作为验证<saml2:Response>的一部分。

默认情况下，Spring Security 使用HttpSessionSaml2AuthenticationRequestRepository，它将AbstractSaml2AuthenticationRequest存储在HttpSession中。

如果您有Saml2AuthenticationRequestRepository的自定义实现，您可以通过将其作为@Bean公开来配置它，如以下示例所示

  • Java

  • Kotlin

@Bean
Saml2AuthenticationRequestRepository<AbstractSaml2AuthenticationRequest> authenticationRequestRepository() {
	return new CustomSaml2AuthenticationRequestRepository();
}
@Bean
open fun authenticationRequestRepository(): Saml2AuthenticationRequestRepository<AbstractSaml2AuthenticationRequest> {
    return CustomSaml2AuthenticationRequestRepository()
}

更改<saml2:AuthnRequest>的发送方式

默认情况下，Spring Security 会对每个<saml2:AuthnRequest>进行签名，并将其作为 GET 请求发送到断言方。

许多断言方不需要签名的<saml2:AuthnRequest>。这可以通过RelyingPartyRegistrations自动配置，或者您可以手动提供，如下所示

不需要签名的 AuthnRequests

  • Boot

  • Java

  • Kotlin

spring:
  security:
    saml2:
      relyingparty:
        okta:
          identityprovider:
            entity-id: ...
            singlesignon.sign-request: false
RelyingPartyRegistration relyingPartyRegistration = RelyingPartyRegistration.withRegistrationId("okta")
        // ...
        .assertingPartyDetails(party -> party
            // ...
            .wantAuthnRequestsSigned(false)
        )
        .build();
var relyingPartyRegistration: RelyingPartyRegistration =
    RelyingPartyRegistration.withRegistrationId("okta")
        // ...
        .assertingPartyDetails { party: AssertingPartyDetails.Builder -> party
                // ...
                .wantAuthnRequestsSigned(false)
        }
        .build();

否则，您需要为RelyingPartyRegistration#signingX509Credentials指定一个私钥，以便 Spring Security 可以在发送<saml2:AuthnRequest>之前对其进行签名。

默认情况下，Spring Security 将使用rsa-sha256对<saml2:AuthnRequest>进行签名，但一些断言方可能需要不同的算法，如它们的元数据中所述。

您可以根据断言方的元数据使用RelyingPartyRegistrations配置算法。

或者，您可以手动提供它

  • Java

  • Kotlin

String metadataLocation = "classpath:asserting-party-metadata.xml";
RelyingPartyRegistration relyingPartyRegistration = RelyingPartyRegistrations.fromMetadataLocation(metadataLocation)
        // ...
        .assertingPartyDetails((party) -> party
            // ...
            .signingAlgorithms((sign) -> sign.add(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512))
        )
        .build();
var metadataLocation = "classpath:asserting-party-metadata.xml"
var relyingPartyRegistration: RelyingPartyRegistration =
    RelyingPartyRegistrations.fromMetadataLocation(metadataLocation)
        // ...
        .assertingPartyDetails { party: AssertingPartyDetails.Builder -> party
                // ...
                .signingAlgorithms { sign: MutableList<String?> ->
                    sign.add(
                        SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512
                    )
                }
        }
        .build();
上面的代码片段使用 OpenSAML 的SignatureConstants类来提供算法名称。但这只是为了方便。由于数据类型是String，您可以直接提供算法的名称。

一些断言方要求<saml2:AuthnRequest>通过 POST 方式发送。这可以通过RelyingPartyRegistrations自动配置，或者您可以手动提供，如下所示

  • Java

  • Kotlin

RelyingPartyRegistration relyingPartyRegistration = RelyingPartyRegistration.withRegistrationId("okta")
        // ...
        .assertingPartyDetails(party -> party
            // ...
            .singleSignOnServiceBinding(Saml2MessageBinding.POST)
        )
        .build();
var relyingPartyRegistration: RelyingPartyRegistration? =
    RelyingPartyRegistration.withRegistrationId("okta")
        // ...
        .assertingPartyDetails { party: AssertingPartyDetails.Builder -> party
            // ...
            .singleSignOnServiceBinding(Saml2MessageBinding.POST)
        }
        .build()

自定义 OpenSAML 的AuthnRequest 实例

您可能需要调整 AuthnRequest 的原因有很多。例如，您可能希望将 ForceAuthN 设置为 true，而 Spring Security 默认将其设置为 false。

您可以通过将 OpenSaml4AuthenticationRequestResolver 作为 @Bean 发布来自定义 OpenSAML 的 AuthnRequest 元素，如下所示

  • Java

  • Kotlin

@Bean
Saml2AuthenticationRequestResolver authenticationRequestResolver(RelyingPartyRegistrationRepository registrations) {
    RelyingPartyRegistrationResolver registrationResolver =
            new DefaultRelyingPartyRegistrationResolver(registrations);
    OpenSaml4AuthenticationRequestResolver authenticationRequestResolver =
            new OpenSaml4AuthenticationRequestResolver(registrationResolver);
    authenticationRequestResolver.setAuthnRequestCustomizer((context) -> context
            .getAuthnRequest().setForceAuthn(true));
    return authenticationRequestResolver;
}
@Bean
fun authenticationRequestResolver(registrations : RelyingPartyRegistrationRepository) : Saml2AuthenticationRequestResolver {
    val registrationResolver : RelyingPartyRegistrationResolver =
            new DefaultRelyingPartyRegistrationResolver(registrations)
    val authenticationRequestResolver : OpenSaml4AuthenticationRequestResolver =
            new OpenSaml4AuthenticationRequestResolver(registrationResolver)
    authenticationRequestResolver.setAuthnRequestCustomizer((context) -> context
            .getAuthnRequest().setForceAuthn(true))
    return authenticationRequestResolver
}