Перенаправление в IdP Автоматически с использованием Spring SAML

Question

Только что начал работать с SAML вчера и столкнулся со всеми проблемами, большинство из которых я разработал. Тем не менее, у меня еще нет, как отключить обнаружение, поэтому Spring автоматически перенаправляет на IdP (у меня его есть только один, а также он установлен по умолчанию) при доступе к любому защищенному ресурсу. Я вижу в документах Springs, что вы можете легко отключить обнаружение, однако в документах, по-видимому, не хватает примеров и/или деталей, поэтому я не совсем уверен, как это сделать.

До сих пор я попытался установить idpSelectionPath на пустые, а также использовать includeDiscoveryExtension и idpDiscoveryEnabled для параметра false. Использование прямого URL-адреса (context/saml/login? Idp = IDP) действительно работает, но не является вариантом, поскольку мое требование заключается в том, что любой защищенный URL автоматически перенаправляется на IdP, если пользователь не выполнил вход.

ниже - рабочая версия моего файла securityContext.xml, так как некоторые изменения, которые я сделал (например, удаление всех параметров обнаружения), вызвали ошибку браузера бесконечного цикла. Любая помощь приветствуется. Благодаря!

<?xml version="1.0" encoding="UTF-8" ?> 
<beans xmlns="http://www.springframework.org/schema/beans" 
    xmlns:security="http://www.springframework.org/schema/security" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns:context="http://www.springframework.org/schema/context" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd 
      http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd"> 

<!-- Enable auto-wiring --> 
<context:annotation-config/> 
<context:component-scan base-package="org.springframework.security.saml"/> 

<!-- Unsecured pages --> 
<security:http security="none" pattern="/saml/web/**"/> 
<security:http security="none" pattern="/logout.jsp"/> 
<security:http security="none" pattern="/favicon.ico"/> 

<!-- Secured pages --> 
<security:http entry-point-ref="samlEntryPoint"> 
    <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY"/> 
    <security:custom-filter before="FIRST" ref="metadataGeneratorFilter"/> 
    <security:custom-filter after="BASIC_AUTH_FILTER" ref="samlFilter"/> 
</security:http> 

<bean id="samlFilter" class="org.springframework.security.web.FilterChainProxy"> 
    <security:filter-chain-map request-matcher="ant"> 
     <security:filter-chain pattern="/saml/login/**" filters="samlEntryPoint"/> 
     <security:filter-chain pattern="/saml/logout/**" filters="samlLogoutFilter"/> 
     <security:filter-chain pattern="/saml/metadata/**" filters="metadataDisplayFilter"/> 
     <security:filter-chain pattern="/saml/SSO/**" filters="samlWebSSOProcessingFilter"/> 
     <security:filter-chain pattern="/saml/SSOHoK/**" filters="samlWebSSOHoKProcessingFilter"/> 
     <security:filter-chain pattern="/saml/SingleLogout/**" filters="samlLogoutProcessingFilter"/> 
     <security:filter-chain pattern="/saml/discovery/**" filters="samlIDPDiscovery"/> 
    </security:filter-chain-map> 
</bean> 

<!-- Handler deciding where to redirect user after successful login --> 
<bean id="successRedirectHandler" 
     class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler"> 
    <property name="defaultTargetUrl" value="/"/> 
</bean> 
<!-- 
Use the following for interpreting RelayState coming from unsolicited response as redirect URL: 
<bean id="successRedirectHandler" class="org.springframework.security.saml.SAMLRelayStateSuccessHandler"> 
    <property name="defaultTargetUrl" value="/" /> 
</bean> 
--> 

<!-- Handler for successful logout --> 
<bean id="successLogoutHandler" class="org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler"> 
    <property name="defaultTargetUrl" value="/logout.jsp"/> 
</bean> 

<!-- Register authentication manager with SAML provider --> 
<security:authentication-manager alias="authenticationManager"> 
    <security:authentication-provider ref="samlAuthenticationProvider"/> 
</security:authentication-manager> 

<!-- Logger for SAML messages and events --> 
<bean id="samlLogger" class="org.springframework.security.saml.log.SAMLDefaultLogger"/> 

<!-- Central storage of cryptographic keys --> 
<bean id="keyManager" class="org.springframework.security.saml.key.JKSKeyManager"> 
    <constructor-arg value="classpath:security/samlKeystore.jks"/> 
    <constructor-arg type="java.lang.String" value="nalle123"/> 
    <constructor-arg> 
     <map> 
      <entry key="apollo" value="nalle123"/> 
     </map> 
    </constructor-arg> 
    <constructor-arg type="java.lang.String" value="apollo"/> 
</bean> 

<!-- Entry point to initialize authentication, default values taken from properties file --> 
<bean id="samlEntryPoint" class="org.springframework.security.saml.SAMLEntryPoint"> 
    <property name="defaultProfileOptions"> 
     <bean class="org.springframework.security.saml.websso.WebSSOProfileOptions"> 
      <property name="includeScoping" value="false"/> 
     </bean> 
    </property> 
</bean> 

<!-- IDP Discovery Service --> 
<bean id="samlIDPDiscovery" class="org.springframework.security.saml.SAMLDiscovery"> 
    <property name="idpSelectionPath" value="/WEB-INF/security/idpSelection.jsp"/> 
</bean> 

<!-- Filter automatically generates default SP metadata --> 

<!-- The filter is waiting for connections on URL suffixed with filterSuffix and presents SP metadata there --> 
<bean id="metadataDisplayFilter" class="org.springframework.security.saml.metadata.MetadataDisplayFilter"/> 

<!-- IDP Metadata configuration - paths to metadata of IDPs in circle of trust is here --> 
<!-- Do no forget to call iniitalize method on providers --> 
<bean id="metadata" class="org.springframework.security.saml.metadata.CachingMetadataManager"> 
<constructor-arg> 
    <list> 
     <bean class="org.springframework.security.saml.metadata.ExtendedMetadataDelegate"> 
<constructor-arg> 
    <bean class="org.opensaml.saml2.metadata.provider.FilesystemMetadataProvider"> 
     <constructor-arg> 
      <value type="java.io.File">C:/SAMLIdP-00D1a000000KR5C.xml</value> 
     </constructor-arg> 
     <property name="parserPool" ref="parserPool"/> 
    </bean> 
</constructor-arg> 
<constructor-arg> 
    <bean class="org.springframework.security.saml.metadata.ExtendedMetadata"/> 
</constructor-arg> 
</bean> 
    </list> 
</constructor-arg> 
<property name="defaultIDP" value="https://mrc-dev-ed.my.salesforce.com"/> 
</bean> 

<!-- SAML Authentication Provider responsible for validating of received SAML messages --> 
<bean id="samlAuthenticationProvider" class="org.springframework.security.saml.SAMLAuthenticationProvider"> 
    <!-- OPTIONAL property: can be used to store/load user data after login --> 
    <!-- 
    <property name="userDetails" ref="bean" /> 
    --> 
</bean> 

<!-- Provider of default SAML Context --> 
<bean id="contextProvider" class="org.springframework.security.saml.context.SAMLContextProviderImpl"/> 

<!-- Processing filter for WebSSO profile messages --> 
<bean id="samlWebSSOProcessingFilter" class="org.springframework.security.saml.SAMLProcessingFilter"> 
    <property name="authenticationManager" ref="authenticationManager"/> 
    <property name="authenticationSuccessHandler" ref="successRedirectHandler"/> 
</bean> 

<!-- Processing filter for WebSSO Holder-of-Key profile --> 
<bean id="samlWebSSOHoKProcessingFilter" class="org.springframework.security.saml.SAMLWebSSOHoKProcessingFilter"> 
    <property name="authenticationManager" ref="authenticationManager"/> 
    <property name="authenticationSuccessHandler" ref="successRedirectHandler"/> 
</bean> 

<!-- Logout handler terminating local session --> 
<bean id="logoutHandler" 
     class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"> 
    <property name="invalidateHttpSession" value="false"/> 
</bean> 

<!-- Override default logout processing filter with the one processing SAML messages --> 
<bean id="samlLogoutFilter" class="org.springframework.security.saml.SAMLLogoutFilter"> 
    <constructor-arg ref="successLogoutHandler"/> 
    <constructor-arg ref="logoutHandler"/> 
    <constructor-arg ref="logoutHandler"/> 
</bean> 

<!-- Filter processing incoming logout messages --> 
<!-- First argument determines URL user will be redirected to after successful global logout --> 
<bean id="samlLogoutProcessingFilter" class="org.springframework.security.saml.SAMLLogoutProcessingFilter"> 
    <constructor-arg ref="successLogoutHandler"/> 
    <constructor-arg ref="logoutHandler"/> 
</bean> 

<!-- Class loading incoming SAML messages from httpRequest stream --> 
<bean id="processor" class="org.springframework.security.saml.processor.SAMLProcessorImpl"> 
    <constructor-arg> 
     <list> 
      <ref bean="redirectBinding"/> 
      <ref bean="postBinding"/> 
      <ref bean="artifactBinding"/> 
      <ref bean="soapBinding"/> 
      <ref bean="paosBinding"/> 
     </list> 
    </constructor-arg> 
</bean> 

<!-- SAML 2.0 WebSSO Assertion Consumer --> 
<bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl"/> 

<!-- SAML 2.0 Holder-of-Key WebSSO Assertion Consumer --> 
<bean id="hokWebSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerHoKImpl"/> 

<!-- SAML 2.0 Web SSO profile --> 
<bean id="webSSOprofile" class="org.springframework.security.saml.websso.WebSSOProfileImpl"/> 

<!-- SAML 2.0 Holder-of-Key Web SSO profile --> 
<bean id="hokWebSSOProfile" class="org.springframework.security.saml.websso.WebSSOProfileConsumerHoKImpl"/> 

<!-- SAML 2.0 ECP profile --> 
<bean id="ecpprofile" class="org.springframework.security.saml.websso.WebSSOProfileECPImpl"/> 

<!-- SAML 2.0 Logout Profile --> 
<bean id="logoutprofile" class="org.springframework.security.saml.websso.SingleLogoutProfileImpl"/> 

<!-- Bindings, encoders and decoders used for creating and parsing messages --> 
<bean id="postBinding" class="org.springframework.security.saml.processor.HTTPPostBinding"> 
    <constructor-arg ref="parserPool"/> 
    <constructor-arg ref="velocityEngine"/> 
</bean> 

<bean id="redirectBinding" class="org.springframework.security.saml.processor.HTTPRedirectDeflateBinding"> 
    <constructor-arg ref="parserPool"/> 
</bean> 

<bean id="artifactBinding" class="org.springframework.security.saml.processor.HTTPArtifactBinding"> 
    <constructor-arg ref="parserPool"/> 
    <constructor-arg ref="velocityEngine"/> 
    <constructor-arg> 
     <bean class="org.springframework.security.saml.websso.ArtifactResolutionProfileImpl"> 
      <constructor-arg> 
       <bean class="org.apache.commons.httpclient.HttpClient"/> 
      </constructor-arg> 
      <property name="processor"> 
       <bean id="soapProcessor" class="org.springframework.security.saml.processor.SAMLProcessorImpl"> 
        <constructor-arg ref="soapBinding"/> 
       </bean> 
      </property> 
     </bean> 
    </constructor-arg> 
</bean> 

<bean id="soapBinding" class="org.springframework.security.saml.processor.HTTPSOAP11Binding"> 
    <constructor-arg ref="parserPool"/> 
</bean> 

<bean id="paosBinding" class="org.springframework.security.saml.processor.HTTPPAOS11Binding"> 
    <constructor-arg ref="parserPool"/> 
</bean> 

<!-- Initialization of OpenSAML library--> 
<bean class="org.springframework.security.saml.SAMLBootstrap"/> 

<!-- Initialization of the velocity engine --> 
<bean id="velocityEngine" class="org.springframework.security.saml.util.VelocityFactory" factory-method="getEngine"/> 

<!-- XML parser pool needed for OpenSAML parsing --> 
<bean id="parserPool" class="org.opensaml.xml.parse.StaticBasicParserPool" scope="singleton" init-method="initialize"/> 
<bean id="parserPoolHolder" class="org.springframework.security.saml.parser.ParserPoolHolder" scope="singleton"/> 
</beans> 

Answer 1

Установка idpDiscoveryEnabled свойство ложной в MetadataGeneratorFilter работал для меня. Что-то наподобие:

<bean id="metadataGeneratorFilter" class="org.springframework.security.saml.metadata.MetadataGeneratorFilter"> 
     <constructor-arg> 
      <bean class="org.springframework.security.saml.metadata.MetadataGenerator"> 
       <property name="extendedMetadata"> 
        <bean class="org.springframework.security.saml.metadata.ExtendedMetadata"> 
         <property name="idpDiscoveryEnabled" value="false"/> 
        </bean> 
       </property> 
      </bean> 
     </constructor-arg> 
    </bean>