com.github.ulisesbocchio.spring.boot.security.saml.configurer.builder

Class MetadataGeneratorConfigurer

java.lang.Object

org.springframework.security.config.annotation.SecurityConfigurerAdapter<Void,ServiceProviderBuilder>

com.github.ulisesbocchio.spring.boot.security.saml.configurer.builder.MetadataGeneratorConfigurer

All Implemented Interfaces:

org.springframework.security.config.annotation.SecurityConfigurer<Void,ServiceProviderBuilder>

public class MetadataGeneratorConfigurer
extends org.springframework.security.config.annotation.SecurityConfigurerAdapter<Void,ServiceProviderBuilder>

Builder configurer that takes care of configuring/customizing the MetadataGenerator, MetadataDisplayFilter, and MetadataGeneratorFilter bean.

This configurer always instantiates its own MetadataGenerator, MetadataDisplayFilter, and MetadataGeneratorFilter based on the specified configuration.

This configurer also reads the values from SAMLSSOProperties#getMetadataGenerator() for some DSL methods if they are not used. In other words, the user is able to configure the filters through the following properties:

     saml.sso.metadata-generator.metadata-url
     saml.sso.metadata-generator.entity-id
     saml.sso.metadata-generator.want-assertion-signed
     saml.sso.metadata-generator.request-signed
     saml.sso.metadata-generator.name-id
     saml.sso.metadata-generator.entity-base-url
     saml.sso.metadata-generator.bindings-sso
     saml.sso.metadata-generator.bindings-hok-sso
     saml.sso.metadata-generator.bindings-slo
     saml.sso.metadata-generator.assertion-consumer-index
     saml.sso.metadata-generator.include-discovery-extension
 

Author:

Ulises Bocchio

Constructor Summary

Constructors

Constructor and Description
MetadataGeneratorConfigurer()
MetadataGeneratorConfigurer(org.springframework.security.saml.metadata.MetadataGenerator metadataGenerator)

Method Summary

Modifier and Type	Method and Description
MetadataGeneratorConfigurer	assertionConsumerIndex(Integer assertionConsumerIndex) Generated assertion consumer service with the index equaling set value will be marked as default.
MetadataGeneratorConfigurer	bindingsHoKSSO(String... bindingsHoKSSO) List of bindings to be included in the generated metadata for Web Single Sign-On Holder of Key.
MetadataGeneratorConfigurer	bindingsSLO(String... bindingsSLO) List of bindings to be included in the generated metadata for Single Logout.
MetadataGeneratorConfigurer	bindingsSSO(String... bindingsSSO) List of bindings to be included in the generated metadata for Web Single Sign-On.
void	configure(ServiceProviderBuilder builder)
MetadataGeneratorConfigurer	entityBaseURL(String entityBaseURL) This Service Provider's entity base URL.
MetadataGeneratorConfigurer	entityId(String entityId) This Service Provider's SAML Entity ID.
MetadataGeneratorConfigurer	id(String id) This Service Provider's SAML ID.
MetadataGeneratorConfigurer	includeDiscoveryExtension(Boolean includeDiscoveryExtension) When true discovery profile extension metadata pointing to the default SAMLEntryPoint will be generated and stored in the generated metadata document.
void	init(ServiceProviderBuilder builder)
MetadataGeneratorConfigurer	metadataURL(String metadataURL) MetadataDisplayFilter processing URL.
MetadataGeneratorConfigurer	nameId(String... nameId) NameIDs to be included in generated metadata.
MetadataGeneratorConfigurer	requestSigned(Boolean requestSigned) Whether Authentication Requests should be signed by this Service Provider or not.
MetadataGeneratorConfigurer	wantAssertionSigned(Boolean wantAssertionSigned) Whether incoming SAML assertions should be signed or not.

Methods inherited from class org.springframework.security.config.annotation.SecurityConfigurerAdapter

addObjectPostProcessor, and, getBuilder, postProcess, setBuilder

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

MetadataGeneratorConfigurer

public MetadataGeneratorConfigurer()

MetadataGeneratorConfigurer

public MetadataGeneratorConfigurer(org.springframework.security.saml.metadata.MetadataGenerator metadataGenerator)

Method Detail

init

public void init(ServiceProviderBuilder builder)
          throws Exception

Specified by:

init in interface org.springframework.security.config.annotation.SecurityConfigurer<Void,ServiceProviderBuilder>

Overrides:

init in class org.springframework.security.config.annotation.SecurityConfigurerAdapter<Void,ServiceProviderBuilder>

Throws:

Exception

configure

public void configure(ServiceProviderBuilder builder)
               throws Exception

Specified by:

configure in interface org.springframework.security.config.annotation.SecurityConfigurer<Void,ServiceProviderBuilder>

Overrides:

configure in class org.springframework.security.config.annotation.SecurityConfigurerAdapter<Void,ServiceProviderBuilder>

Throws:

Exception

metadataURL

public MetadataGeneratorConfigurer metadataURL(String metadataURL)

MetadataDisplayFilter processing URL. Defines which URL will display the Service Provider Metadata. Default is "/saml/metadata".

Alternatively use property:

      saml.sso.metadata-generator.metadata-url
 

Parameters:

metadataURL - the metadata display filter processing URL.

Returns:

this configurer for further customization

entityId

public MetadataGeneratorConfigurer entityId(String entityId)

This Service Provider's SAML Entity ID. Used as entity id for generated requests from this Service Provider. Default is "localhost".

Alternatively use property:

      saml.sso.metadata-generator.entity-id
 

Parameters:

entityId - the entity id of this Service Provider.

Returns:

this configurer for further customization

id

public MetadataGeneratorConfigurer id(String id)

This Service Provider's SAML ID. Used as ID of EntityDescriptor managed by MetadataGenerator. Default is null.

Alternatively use property:

      saml.sso.metadata-generator.id
 

Parameters:

id - the id.

Returns:

this configurer for further customization

wantAssertionSigned

public MetadataGeneratorConfigurer wantAssertionSigned(Boolean wantAssertionSigned)

Whether incoming SAML assertions should be signed or not. Default is true.

Alternatively use property:

      saml.sso.metadata-generator.want-assertion-signed
 

Parameters:

wantAssertionSigned - true if assertions are wanted signed.

Returns:

this configurer for further customization

requestSigned

public MetadataGeneratorConfigurer requestSigned(Boolean requestSigned)

Whether Authentication Requests should be signed by this Service Provider or not.

Alternatively use property:

      saml.sso.metadata-generator.request-signed
 

Parameters:

requestSigned - true if authentication requests should be signed.

Returns:

this configurer for further customization

nameId

public MetadataGeneratorConfigurer nameId(String... nameId)

NameIDs to be included in generated metadata.

Alternatively use property:

      saml.sso.metadata-generator.name-id
 

Parameters:

nameId - the name IDs to be included in generated metadata.

Returns:

this configurer for further customization

entityBaseURL

public MetadataGeneratorConfigurer entityBaseURL(String entityBaseURL)

This Service Provider's entity base URL. Provide if base URL cannot be inferred by using the hostname where the Service Provider will be running. I.E. if running on the cloud behind a load balancer.

Alternatively use property:

      saml.sso.metadata-generator.entity-base-url
 

Parameters:

entityBaseURL - the Service Provider base URL.

Returns:

this configurer for further customization

bindingsHoKSSO

public MetadataGeneratorConfigurer bindingsHoKSSO(String... bindingsHoKSSO)

List of bindings to be included in the generated metadata for Web Single Sign-On Holder of Key. Ordering of bindings affects inclusion in the generated metadata. Supported values are: "artifact" (or "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact") and "post" (or "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"). By default there are no included bindings for the profile.

Alternatively use property:

      saml.sso.metadata-generator.bindings-hok-sso
 

Parameters:

bindingsHoKSSO - bindings for web single sign-on holder-of-key

Returns:

this configurer for further customization

bindingsSLO

public MetadataGeneratorConfigurer bindingsSLO(String... bindingsSLO)

List of bindings to be included in the generated metadata for Single Logout. Ordering of bindings affects inclusion in the generated metadata. Supported values are: "post" (or "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST") and "redirect" (or "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"). The following bindings are included by default: "post", "redirect".

Alternatively use property:

      saml.sso.metadata-generator.bindings-slo
 

Parameters:

bindingsSLO - bindings for single logout

Returns:

this configurer for further customization

bindingsSSO

public MetadataGeneratorConfigurer bindingsSSO(String... bindingsSSO)

List of bindings to be included in the generated metadata for Web Single Sign-On. Ordering of bindings affects inclusion in the generated metadata. Supported values are: "artifact" (or "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"), "post" (or "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST") and "paos" (or "urn:oasis:names:tc:SAML:2.0:bindings:PAOS"). The following bindings are included by default: "artifact", "post".

Alternatively use property:

      saml.sso.metadata-generator.bindings-sso
 

Parameters:

bindingsSSO - bindings for web single sign-on

Returns:

this configurer for further customization

assertionConsumerIndex

public MetadataGeneratorConfigurer assertionConsumerIndex(Integer assertionConsumerIndex)

Generated assertion consumer service with the index equaling set value will be marked as default. Use negative value to skip the default attribute altogether. Default is 0.

Alternatively use property:

      saml.sso.metadata-generator.assertion-consumer-index
 

Parameters:

assertionConsumerIndex - assertion consumer index of service to mark as default

Returns:

this configurer for further customization

includeDiscoveryExtension

public MetadataGeneratorConfigurer includeDiscoveryExtension(Boolean includeDiscoveryExtension)

When true discovery profile extension metadata pointing to the default SAMLEntryPoint will be generated and stored in the generated metadata document.

Alternatively use property:

      saml.sso.metadata-generator.include-discovery-extension
 

Parameters:

includeDiscoveryExtension - flag indicating whether IDP discovery should be enabled

Returns:

this configurer for further customization