com.github.ulisesbocchio.spring.boot.security.saml.bean

Class SAMLConfigurerBean

java.lang.Object

org.springframework.security.config.annotation.SecurityConfigurerAdapter<org.springframework.security.web.DefaultSecurityFilterChain,org.springframework.security.config.annotation.web.builders.HttpSecurity>

com.github.ulisesbocchio.spring.boot.security.saml.bean.SAMLConfigurerBean

All Implemented Interfaces:

org.springframework.beans.factory.InitializingBean, org.springframework.security.config.annotation.SecurityConfigurer<org.springframework.security.web.DefaultSecurityFilterChain,org.springframework.security.config.annotation.web.builders.HttpSecurity>

public class SAMLConfigurerBean
extends org.springframework.security.config.annotation.SecurityConfigurerAdapter<org.springframework.security.web.DefaultSecurityFilterChain,org.springframework.security.config.annotation.web.builders.HttpSecurity>
implements org.springframework.beans.factory.InitializingBean

Spring Security SecurityConfigurerAdapter implementation to load the actual SAML configuration into Spring Security. Can be used Standalone as a Spring Bean in conjunction with WebSecurityConfigurerAdapter and EnableSAMLSSO like this:

     @SpringBootApplication
     @EnableSAMLSSO
     public class OktaSSODemoApplication2 {

        public static void main(String[] args) {
            SpringApplication.run(OktaSSODemoApplication2.class, args);
        }

        @Configuration
        public static class MvcConfig implements WebMvcConfigurer {

            @Override
            public void addViewControllers(ViewControllerRegistry registry) {
                registry.addViewController("/").setViewName("index");
                registry.addViewController("/protected").setViewName("protected");
                registry.addViewController("/unprotected/help").setViewName("help");

            }
        }

        @Configuration
        public static class MyServiceProviderConfig extends WebSecurityConfigurerAdapter {

            public MyServiceProviderConfig() {
                super(false);
            }

            @Bean
            SAMLConfigurerBean saml() {
                return new SAMLConfigurerBean();
            }

            @Override
            public void configure(WebSecurity web) throws Exception {
                super.configure(web);
            }

            @Bean
            public AuthenticationManager authenticationManagerBean() throws Exception {
                return super.authenticationManagerBean();
            }

            @Override
            protected void configure(HttpSecurity http) throws Exception {
                // @formatter:off
                http.authorizeRequests()
                    .antMatchers("/unprotected/**")
                    .permitAll()
                .and()
                    .httpBasic()
                    .disable()
                    .csrf()
                    .disable()
                    .anonymous()
                .and()
                    .apply(saml())
                    .serviceProvider()
                        .metadataGenerator()
                        .entityId("localhost-demo")
                        .bindingsSSO("artifact", "post", "paos")
                    .and()
                       .ecpProfile()
                    .and()
                        .sso()
                        .defaultSuccessURL("/home")
                        .idpSelectionPageURL("/idpselection")
                    .and()
                        .metadataManager()
                        .metadataLocations("classpath:/idp-okta.xml")
                        .refreshCheckInterval(0)
                    .and()
                        .extendedMetadata()
                        .ecpEnabled(true)
                        .idpDiscoveryEnabled(true)//set to false for no IDP Selection page.
                    .and()
                        .keyManager()
                        .privateKeyDERLocation("classpath:/localhost.key.der")
                        .publicKeyPEMLocation("classpath:/localhost.cert")
                    .and()
                .http()
                    .authorizeRequests()
                    .requestMatchers(saml().endpointsMatcher()).permitAll()
                .and()
                    .authorizeRequests()
                    .anyRequest()
                    .authenticated();
                // @formatter:on
            }
        }
    }
 

Author:

Ulises Bocchio

Field Summary

Fields

Modifier and Type	Field and Description
protected org.springframework.security.authentication.AuthenticationManager	authenticationManager
protected ServiceProviderBuilder	serviceProviderBuilder

Constructor Summary

Constructors

Constructor and Description
SAMLConfigurerBean() Default Constructor to be used withing Dependency Injection Container only.
SAMLConfigurerBean(ServiceProviderBuilder serviceProviderBuilder, org.springframework.security.authentication.AuthenticationManager authenticationManager) Constructor for Standalone initialization.

Method Summary

Modifier and Type	Method and Description
protected void	addFilter(org.springframework.security.config.annotation.web.builders.HttpSecurity http, Class<? extends javax.servlet.Filter> filterClass)
void	afterPropertiesSet()
void	configure(org.springframework.security.config.annotation.web.builders.HttpSecurity http)
org.springframework.security.web.util.matcher.RequestMatcher	endpointsMatcher() Returns a request RequestMatcher that matches all the SAML endpoints configured by the user: defaultFailureURL, ssoProcessingURL, ssoHoKProcessingURL, discoveryProcessingURL, idpSelectionPageURL, ssoLoginURL, metadataURL, defaultTargetURL, logoutURL and singleLogoutURL.
void	init(org.springframework.security.config.annotation.web.builders.HttpSecurity http)
ServiceProviderBuilder	serviceProvider() Returns The ServiceProviderBuilder for customization of the SAML Service Provider
ServiceProviderBuilder	serviceProvider(List<ServiceProviderConfigurer> serviceProviderConfigurers) Returns The ServiceProviderBuilder for customization of the SAML Service Provider
void	setBuilder(org.springframework.security.config.annotation.web.builders.HttpSecurity httpSecurity)

Methods inherited from class org.springframework.security.config.annotation.SecurityConfigurerAdapter

addObjectPostProcessor, and, getBuilder, postProcess

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

serviceProviderBuilder

@Autowired
protected ServiceProviderBuilder serviceProviderBuilder

authenticationManager

@Autowired
protected org.springframework.security.authentication.AuthenticationManager authenticationManager

Constructor Detail

SAMLConfigurerBean

public SAMLConfigurerBean()

Default Constructor to be used withing Dependency Injection Container only.

SAMLConfigurerBean

public SAMLConfigurerBean(ServiceProviderBuilder serviceProviderBuilder,
                          org.springframework.security.authentication.AuthenticationManager authenticationManager)

Constructor for Standalone initialization.

Parameters:

serviceProviderBuilder - The Service Provider Builder to get SAML configuration from.

authenticationManager - The Authentication Manager to setup Spring Security with.

Method Detail

afterPropertiesSet

public void afterPropertiesSet()
                        throws Exception

Specified by:

afterPropertiesSet in interface org.springframework.beans.factory.InitializingBean

Throws:

Exception

serviceProvider

public ServiceProviderBuilder serviceProvider()

Returns The ServiceProviderBuilder for customization of the SAML Service Provider

Returns:

The ServiceProviderBuilder for customization of the SAML Service Provider

serviceProvider

public ServiceProviderBuilder serviceProvider(List<ServiceProviderConfigurer> serviceProviderConfigurers)

Returns The ServiceProviderBuilder for customization of the SAML Service Provider

Parameters:

serviceProviderConfigurers - A list ServiceProviderConfigurer to apply to the ServiceProviderBuilder before it is returned.

Returns:

The ServiceProviderBuilder for customization of the SAML Service Provider

endpointsMatcher

public org.springframework.security.web.util.matcher.RequestMatcher endpointsMatcher()

Returns a request RequestMatcher that matches all the SAML endpoints configured by the user: defaultFailureURL, ssoProcessingURL, ssoHoKProcessingURL, discoveryProcessingURL, idpSelectionPageURL, ssoLoginURL, metadataURL, defaultTargetURL, logoutURL and singleLogoutURL. To be used with HttpSecurity.authorizeRequests() in this fashion:

     http
       .authorizeRequests()
       .requestMatchers(samlConfigurerBean.endpointsMatcher())
       .permitAll()
 

So that all the configured URLs can bypass security.

Returns:

the RequestMatcher

setBuilder

public void setBuilder(org.springframework.security.config.annotation.web.builders.HttpSecurity httpSecurity)

Overrides:

setBuilder in class org.springframework.security.config.annotation.SecurityConfigurerAdapter<org.springframework.security.web.DefaultSecurityFilterChain,org.springframework.security.config.annotation.web.builders.HttpSecurity>

init

public void init(org.springframework.security.config.annotation.web.builders.HttpSecurity http)
          throws Exception

Specified by:

init in interface org.springframework.security.config.annotation.SecurityConfigurer<org.springframework.security.web.DefaultSecurityFilterChain,org.springframework.security.config.annotation.web.builders.HttpSecurity>

Overrides:

init in class org.springframework.security.config.annotation.SecurityConfigurerAdapter<org.springframework.security.web.DefaultSecurityFilterChain,org.springframework.security.config.annotation.web.builders.HttpSecurity>

Throws:

Exception

configure

public void configure(org.springframework.security.config.annotation.web.builders.HttpSecurity http)
               throws Exception

Specified by:

configure in interface org.springframework.security.config.annotation.SecurityConfigurer<org.springframework.security.web.DefaultSecurityFilterChain,org.springframework.security.config.annotation.web.builders.HttpSecurity>

Overrides:

configure in class org.springframework.security.config.annotation.SecurityConfigurerAdapter<org.springframework.security.web.DefaultSecurityFilterChain,org.springframework.security.config.annotation.web.builders.HttpSecurity>

Throws:

Exception

addFilter

protected void addFilter(org.springframework.security.config.annotation.web.builders.HttpSecurity http,
                         Class<? extends javax.servlet.Filter> filterClass)