Geek Answers Handbook

Configuring the POST Protocol in Spring SAML Security Check Request

Spring SAML Security insists on requesting an Artifact binding in a SAML authentication request (ProtocolBinding attribute):

<saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="http://sp.com/saml/SSO/alias/defaultAlias" Destination="https://idp.com/idp" ForceAuthn="false" ID="a4acj06d42fdc0d3494h859g3f7005c" IsPassive="false" IssueInstant="2012-12-05T17:07:18.271Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Version="2.0" >

How can I configure POST binding? Thanks for any answers!

- Andreas

+4
source share
2 answers

Thanks to nobby and Sanjeev, I recently applied this to a similar case, and it set me on the right track.

Being very new to the SAML2 Spring security extension, I had to work a bit to apply WebSSOProfileOptions. Essentially, to get the HTTP-POST binding in a SAML verification request, you need the profile parameters passed to the org.springframework.security.saml.websso.WebSSOProfileImpl#sendAuthenticationRequest() method.

For our configuration, which is very similar to the configuration in the Spring RC2 sample project , this meant passing the WebSSOProfileOptions bean as described in Sanjeev's solution for the samlEntryPoint.defaultProfileOptions property (or adding a binding property to it).

The problem is that this did not cause AuthnRequest to dial the binding property as set. In our case, SAML metadata pointed isDefault=true to the HTTP-Artifact AssertionConsumerService link. And in our RC2 version of Spring SAML2, the RC2 library is the default behavior of org.springframework.security.saml.metadata.MetadataGenerator .

This can be overridden by setting the assertionConsumerIndex property in the MetadataGenerator. In our case, the HTTP Post post user is set to index 1.

 <bean id="metadataGeneratorFilter" class="org.springframework.security.saml.metadata.MetadataGeneratorFilter"> <constructor-arg> <bean class="org.springframework.security.saml.metadata.MetadataGenerator"> <property name="assertionConsumerIndex" value="1" /><!-- 1=HTTP-POST --> </bean> </constructor-arg> </bean>
+6
source

An sp-init binding can be specified in securityContext.xml . The example below uses HTTP POST

  <bean class="org.springframework.security.saml.websso.WebSSOProfileOptions"> <property name="includeScoping" value="false"/> <property name="binding" value="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/> </bean>

org.opensaml.common.xml.SAMLConstants values ​​can be found in the class org.opensaml.common.xml.SAMLConstants .

+2
source

More articles:


All Articles