Skip to content

Commit 78a0173

Browse files
jzheauxjzheaux
committed
Use OpenSAML API for web
Issue gh-11658
1 parent bf5b334 commit 78a0173

File tree

13 files changed

+1576
-239
lines changed

13 files changed

+1576
-239
lines changed

‎config/src/main/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurer.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
4040
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrations;
4141
import org.springframework.security.saml2.provider.service.web.HttpSessionSaml2AuthenticationRequestRepository;
42-
import org.springframework.security.saml2.provider.service.web.OpenSamlAuthenticationTokenConverter;
42+
import org.springframework.security.saml2.provider.service.web.OpenSaml4AuthenticationTokenConverter;
4343
import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationRequestRepository;
4444
import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationTokenConverter;
4545
import org.springframework.security.saml2.provider.service.web.Saml2WebSsoAuthenticationRequestFilter;
@@ -379,10 +379,10 @@ private AuthenticationConverter getAuthenticationConverter(B http) {
379379
AuthenticationConverter authenticationConverterBean = getBeanOrNull(http,
380380
Saml2AuthenticationTokenConverter.class);
381381
if (authenticationConverterBean == null) {
382-
authenticationConverterBean = getBeanOrNull(http, OpenSamlAuthenticationTokenConverter.class);
382+
authenticationConverterBean = getBeanOrNull(http, OpenSaml4AuthenticationTokenConverter.class);
383383
}
384384
if (authenticationConverterBean == null) {
385-
OpenSamlAuthenticationTokenConverter converter = new OpenSamlAuthenticationTokenConverter(
385+
OpenSaml4AuthenticationTokenConverter converter = new OpenSaml4AuthenticationTokenConverter(
386386
this.relyingPartyRegistrationRepository);
387387
converter.setAuthenticationRequestRepository(getAuthenticationRequestRepository(http));
388388
converter.setRequestMatcher(this.loginProcessingUrl);

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurerTests.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -308,7 +308,7 @@ public void authenticateWithInvalidDeflatedSAMLResponseThenFailureHandlerUses()
308308
Saml2AuthenticationException exception = captor.getValue();
309309
assertThat(exception.getSaml2Error().getErrorCode()).isEqualTo(Saml2ErrorCodes.INVALID_RESPONSE);
310310
assertThat(exception.getSaml2Error().getDescription()).isEqualTo("Unable to inflate string");
311-
assertThat(exception.getCause()).isInstanceOf(IOException.class);
311+
assertThat(exception).hasRootCauseInstanceOf(IOException.class);
312312
}
313313

314314
@Test

‎saml2/saml2-service-provider/spring-security-saml2-service-provider.gradle

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,11 @@ sourceSets.configureEach { set ->
3838
with from
3939
}
4040

41+
copy {
42+
into "$projectDir/src/$set.name/java/org/springframework/security/saml2/provider/service/web"
43+
filter { line -> line.replaceAll(".saml2.internal", ".saml2.provider.service.web") }
44+
with from
45+
}
4146
}
4247

4348
dependencies {

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/BaseOpenSamlAuthenticationTokenConverter.java

Lines changed: 190 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,190 @@
1+
/*
2+
* Copyright 2002-2024 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.saml2.provider.service.web;
18+
19+
import jakarta.servlet.http.HttpServletRequest;
20+
import org.opensaml.saml.saml2.core.Response;
21+
22+
import org.springframework.http.HttpMethod;
23+
import org.springframework.security.saml2.core.OpenSamlInitializationService;
24+
import org.springframework.security.saml2.core.Saml2Error;
25+
import org.springframework.security.saml2.core.Saml2ErrorCodes;
26+
import org.springframework.security.saml2.core.Saml2ParameterNames;
27+
import org.springframework.security.saml2.provider.service.authentication.AbstractSaml2AuthenticationRequest;
28+
import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationException;
29+
import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationToken;
30+
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
31+
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
32+
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationPlaceholderResolvers.UriResolver;
33+
import org.springframework.security.web.authentication.AuthenticationConverter;
34+
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
35+
import org.springframework.security.web.util.matcher.OrRequestMatcher;
36+
import org.springframework.security.web.util.matcher.RequestMatcher;
37+
import org.springframework.util.Assert;
38+
39+
final class BaseOpenSamlAuthenticationTokenConverter implements AuthenticationConverter {
40+
41+
static {
42+
OpenSamlInitializationService.initialize();
43+
}
44+
45+
private final OpenSamlOperations saml;
46+
47+
private final RelyingPartyRegistrationRepository registrations;
48+
49+
private RequestMatcher requestMatcher = new OrRequestMatcher(
50+
new AntPathRequestMatcher("/login/saml2/sso/{registrationId}"),
51+
new AntPathRequestMatcher("/login/saml2/sso"));
52+
53+
private Saml2AuthenticationRequestRepository<?> authenticationRequests = new HttpSessionSaml2AuthenticationRequestRepository();
54+
55+
/**
56+
* Constructs a {@link BaseOpenSamlAuthenticationTokenConverter} given a repository
57+
* for {@link RelyingPartyRegistration}s
58+
* @param registrations the repository for {@link RelyingPartyRegistration}s
59+
* {@link RelyingPartyRegistration}s
60+
*/
61+
BaseOpenSamlAuthenticationTokenConverter(RelyingPartyRegistrationRepository registrations,
62+
OpenSamlOperations saml) {
63+
Assert.notNull(registrations, "relyingPartyRegistrationRepository cannot be null");
64+
this.registrations = registrations;
65+
this.saml = saml;
66+
}
67+
68+
/**
69+
* Resolve an authentication request from the given {@link HttpServletRequest}.
70+
*
71+
* <p>
72+
* First uses the configured {@link RequestMatcher} to deduce whether an
73+
* authentication request is being made and optionally for which
74+
* {@code registrationId}.
75+
*
76+
* <p>
77+
* If there is an associated {@code <saml2:AuthnRequest>}, then the
78+
* {@code registrationId} is looked up and used.
79+
*
80+
* <p>
81+
* If a {@code registrationId} is found in the request, then it is looked up and used.
82+
* In that case, if none is found a {@link Saml2AuthenticationException} is thrown.
83+
*
84+
* <p>
85+
* Finally, if no {@code registrationId} is found in the request, then the code
86+
* attempts to resolve the {@link RelyingPartyRegistration} from the SAML Response's
87+
* Issuer.
88+
* @param request the HTTP request
89+
* @return the {@link Saml2AuthenticationToken} authentication request
90+
* @throws Saml2AuthenticationException if the {@link RequestMatcher} specifies a
91+
* non-existent {@code registrationId}
92+
*/
93+
@Override
94+
public Saml2AuthenticationToken convert(HttpServletRequest request) {
95+
String serialized = request.getParameter(Saml2ParameterNames.SAML_RESPONSE);
96+
if (serialized == null) {
97+
return null;
98+
}
99+
RequestMatcher.MatchResult result = this.requestMatcher.matcher(request);
100+
if (!result.isMatch()) {
101+
return null;
102+
}
103+
Saml2AuthenticationToken token = tokenByAuthenticationRequest(request);
104+
if (token == null) {
105+
token = tokenByRegistrationId(request, result);
106+
}
107+
if (token == null) {
108+
token = tokenByEntityId(request);
109+
}
110+
return token;
111+
}
112+
113+
private Saml2AuthenticationToken tokenByAuthenticationRequest(HttpServletRequest request) {
114+
AbstractSaml2AuthenticationRequest authenticationRequest = this.authenticationRequests
115+
.loadAuthenticationRequest(request);
116+
if (authenticationRequest == null) {
117+
return null;
118+
}
119+
String registrationId = authenticationRequest.getRelyingPartyRegistrationId();
120+
RelyingPartyRegistration registration = this.registrations.findByRegistrationId(registrationId);
121+
return tokenByRegistration(request, registration, authenticationRequest);
122+
}
123+
124+
private Saml2AuthenticationToken tokenByRegistrationId(HttpServletRequest request,
125+
RequestMatcher.MatchResult result) {
126+
String registrationId = result.getVariables().get("registrationId");
127+
if (registrationId == null) {
128+
return null;
129+
}
130+
RelyingPartyRegistration registration = this.registrations.findByRegistrationId(registrationId);
131+
return tokenByRegistration(request, registration, null);
132+
}
133+
134+
private Saml2AuthenticationToken tokenByEntityId(HttpServletRequest request) {
135+
Response response = this.saml.deserialize(decode(request));
136+
String issuer = response.getIssuer().getValue();
137+
RelyingPartyRegistration registration = this.registrations.findUniqueByAssertingPartyEntityId(issuer);
138+
return tokenByRegistration(request, registration, null);
139+
}
140+
141+
private Saml2AuthenticationToken tokenByRegistration(HttpServletRequest request,
142+
RelyingPartyRegistration registration, AbstractSaml2AuthenticationRequest authenticationRequest) {
143+
if (registration == null) {
144+
return null;
145+
}
146+
String decoded = decode(request);
147+
UriResolver resolver = RelyingPartyRegistrationPlaceholderResolvers.uriResolver(request, registration);
148+
registration = registration.mutate()
149+
.entityId(resolver.resolve(registration.getEntityId()))
150+
.assertionConsumerServiceLocation(resolver.resolve(registration.getAssertionConsumerServiceLocation()))
151+
.build();
152+
return new Saml2AuthenticationToken(registration, decoded, authenticationRequest);
153+
}
154+
155+
/**
156+
* Use the given {@link Saml2AuthenticationRequestRepository} to load authentication
157+
* request.
158+
* @param authenticationRequestRepository the
159+
* {@link Saml2AuthenticationRequestRepository} to use
160+
*/
161+
void setAuthenticationRequestRepository(
162+
Saml2AuthenticationRequestRepository<AbstractSaml2AuthenticationRequest> authenticationRequestRepository) {
163+
Assert.notNull(authenticationRequestRepository, "authenticationRequestRepository cannot be null");
164+
this.authenticationRequests = authenticationRequestRepository;
165+
}
166+
167+
/**
168+
* Use the given {@link RequestMatcher} to match the request.
169+
* @param requestMatcher the {@link RequestMatcher} to use
170+
*/
171+
void setRequestMatcher(RequestMatcher requestMatcher) {
172+
Assert.notNull(requestMatcher, "requestMatcher cannot be null");
173+
this.requestMatcher = requestMatcher;
174+
}
175+
176+
private String decode(HttpServletRequest request) {
177+
String encoded = request.getParameter(Saml2ParameterNames.SAML_RESPONSE);
178+
try {
179+
return Saml2Utils.withEncoded(encoded)
180+
.requireBase64(true)
181+
.inflate(HttpMethod.GET.matches(request.getMethod()))
182+
.decode();
183+
}
184+
catch (Exception ex) {
185+
throw new Saml2AuthenticationException(new Saml2Error(Saml2ErrorCodes.INVALID_RESPONSE, ex.getMessage()),
186+
ex);
187+
}
188+
}
189+
190+
}

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/OpenSaml4AuthenticationTokenConverter.java

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
/*
2+
* Copyright 2002-2023 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.saml2.provider.service.web;
18+
19+
import jakarta.servlet.http.HttpServletRequest;
20+
21+
import org.springframework.security.saml2.provider.service.authentication.AbstractSaml2AuthenticationRequest;
22+
import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationException;
23+
import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationToken;
24+
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
25+
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
26+
import org.springframework.security.web.authentication.AuthenticationConverter;
27+
import org.springframework.security.web.util.matcher.RequestMatcher;
28+
import org.springframework.util.Assert;
29+
30+
/**
31+
* An {@link AuthenticationConverter} that generates a {@link Saml2AuthenticationToken}
32+
* appropriate for authenticated a SAML 2.0 Assertion against an
33+
* {@link org.springframework.security.authentication.AuthenticationManager}.
34+
*
35+
* @author Josh Cummings
36+
* @since 6.1
37+
*/
38+
public final class OpenSaml4AuthenticationTokenConverter implements AuthenticationConverter {
39+
40+
private final BaseOpenSamlAuthenticationTokenConverter delegate;
41+
42+
/**
43+
* Constructs a {@link OpenSaml4AuthenticationTokenConverter} given a repository for
44+
* {@link RelyingPartyRegistration}s
45+
* @param registrations the repository for {@link RelyingPartyRegistration}s
46+
* {@link RelyingPartyRegistration}s
47+
*/
48+
public OpenSaml4AuthenticationTokenConverter(RelyingPartyRegistrationRepository registrations) {
49+
Assert.notNull(registrations, "relyingPartyRegistrationRepository cannot be null");
50+
this.delegate = new BaseOpenSamlAuthenticationTokenConverter(registrations, new OpenSaml4Template());
51+
}
52+
53+
/**
54+
* Resolve an authentication request from the given {@link HttpServletRequest}.
55+
*
56+
* <p>
57+
* First uses the configured {@link RequestMatcher} to deduce whether an
58+
* authentication request is being made and optionally for which
59+
* {@code registrationId}.
60+
*
61+
* <p>
62+
* If there is an associated {@code <saml2:AuthnRequest>}, then the
63+
* {@code registrationId} is looked up and used.
64+
*
65+
* <p>
66+
* If a {@code registrationId} is found in the request, then it is looked up and used.
67+
* In that case, if none is found a {@link Saml2AuthenticationException} is thrown.
68+
*
69+
* <p>
70+
* Finally, if no {@code registrationId} is found in the request, then the code
71+
* attempts to resolve the {@link RelyingPartyRegistration} from the SAML Response's
72+
* Issuer.
73+
* @param request the HTTP request
74+
* @return the {@link Saml2AuthenticationToken} authentication request
75+
* @throws Saml2AuthenticationException if the {@link RequestMatcher} specifies a
76+
* non-existent {@code registrationId}
77+
*/
78+
@Override
79+
public Saml2AuthenticationToken convert(HttpServletRequest request) {
80+
return this.delegate.convert(request);
81+
}
82+
83+
/**
84+
* Use the given {@link Saml2AuthenticationRequestRepository} to load authentication
85+
* request.
86+
* @param authenticationRequestRepository the
87+
* {@link Saml2AuthenticationRequestRepository} to use
88+
*/
89+
public void setAuthenticationRequestRepository(
90+
Saml2AuthenticationRequestRepository<AbstractSaml2AuthenticationRequest> authenticationRequestRepository) {
91+
Assert.notNull(authenticationRequestRepository, "authenticationRequestRepository cannot be null");
92+
this.delegate.setAuthenticationRequestRepository(authenticationRequestRepository);
93+
}
94+
95+
/**
96+
* Use the given {@link RequestMatcher} to match the request.
97+
* @param requestMatcher the {@link RequestMatcher} to use
98+
*/
99+
public void setRequestMatcher(RequestMatcher requestMatcher) {
100+
Assert.notNull(requestMatcher, "requestMatcher cannot be null");
101+
this.delegate.setRequestMatcher(requestMatcher);
102+
}
103+
104+
}

0 commit comments

Comments
 (0)