uniquejava
commented
1 year ago For spring boot, this is the dependency I added in pom.xml.
<!-- https://mvnrepository.com/artifact/org.springframework.security/spring-security-saml2-service-provider -->
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-saml2-service-provider</artifactId>
</dependency>
And then I was able to extract saml attributes by configuring a SecurityBean.
The assertion.getAttributeStatements().stream() part.
@EnableWebSecurity
public class BootSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
RelyingPartyRegistrationRepository relyingPartyRegistrationRepository;
@Override
protected void configure(HttpSecurity http) throws Exception {
// Create a filter to generate a SAML Metadata file for the Application
Saml2MetadataFilter filter = new Saml2MetadataFilter(
(RelyingPartyRegistrationResolver)new DefaultRelyingPartyRegistrationResolver(this.relyingPartyRegistrationRepository),
new OpenSamlMetadataResolver());
// No Transformation of Authorities done
GrantedAuthoritiesMapper authoritiesMapper = (authCol -> authCol);
// Actual code to extract the Authorities (or roles) from the Assertion
Converter<Assertion, Collection<? extends GrantedAuthority>> authoritiesExtractor = assertion -> {
List<SimpleGrantedAuthority> userRoles
= assertion.getAttributeStatements().stream()
.map(AttributeStatement::getAttributes)
.flatMap(Collection::stream)
.filter(attr -> "groups".equalsIgnoreCase(attr.getName()))
.map(Attribute::getAttributeValues)
.flatMap(Collection::stream)
.map(xml -> new SimpleGrantedAuthority("ROLE_" + xml.getDOM().getTextContent()))
.toList();
return userRoles;
};
http
.saml2Login()
.addObjectPostProcessor(new ObjectPostProcessor<OpenSamlAuthenticationProvider>() {
public <P extends OpenSamlAuthenticationProvider> P postProcess(
P samlAuthProvider) {
// Set the Authorities extractor
samlAuthProvider.setAuthoritiesExtractor(authoritiesExtractor);
samlAuthProvider.setAuthoritiesMapper(authoritiesMapper);
return samlAuthProvider;
}
});
http
.saml2Logout(withDefaults())
.addFilterBefore(filter, Saml2WebSsoAuthenticationFilter.class)
.authorizeRequests()
.mvcMatchers("/", "/api").hasAnyRole("user","admin")
.mvcMatchers("/edit/**").hasAnyRole("admin")
.mvcMatchers("/css/**").permitAll()
.anyRequest().denyAll();
}
}And then, use the Authentication object anywhere in Rest Controller to get user attributes/groups.
Hello.
We are moving from Spring Boot to OpenLiberty. Spring Security has SAML support and after studying OpenLiberty documents, especially the SAML Web SSO part, I defined the following configuration file.
Now when I access the Backend API - a JAX-RS project , browser redirects me to IDP login page, and I was able to get SAML Response after enter user credentials.
The SAML response likes the following, (As some test, I tried Okta and Keycloak as IDP provider, they are similar)
My question is there any SAML ACS Url callback for us to Post Process SAML Token?
And also How can I get Custom User Attributes especially User Groups from SAML Token and put it into http session for wrap them into a JWT token?
I tried to inject SecurityContext into a Resource class like this.
For now, I can only get user's principal (email) in my case. I want to get other attributes like "first, last name, age, title, groups" etc.
Later, I found this class com.ibm.wsspi.security.saml2.UserCredentialResolver, the description looks quite promising to me.
I don't know where to find this class, I search maven repository and can't find any related maven dependency.
Would you please kindly shed me some light how to continue?