SAML Extension can be deployed in scenarios where multiple back-end servers process SAML requests forwarded by a reverse-proxy or a load balancer. SSL termination proxies which communicate using an unencrypted channel between the proxy and back-end servers are also supported. In order to configure SAML Extension for deployment behind a load balancer or a reverse-proxy please follow these steps:

Context provider populates information about the local service provider (your application) such as entityId, role, metadata, security keys, SSL credentials and trust engines for verification of signatures and SSL/TLS connections. Once populated context is made available to all components participating in processing of the incoming or outgoing SAML messages. ContextProvider can customized to alter behavior of the SAML Extension. The default implementation org.springframework.security.saml.context.SAMLContextProviderImpl relies on information available in the ExtendedMetadata and performs the following steps for creation of the context:

During initialization of SSO ContextProvider is also requested to provide metadata of the peer IDP. System performs these steps to locate peer IDP to use:

For security reasons system limits the time window enabling processing of SAML messages and assertions. The time window parameters can be customized with the following settings.

Validity of assertions processed during the signle sign-on process is limited to 3000 seconds. Value can be customized with property maxAssertionTime of the WebSSOProfileConsumerImpl bean.

System allows users to single sign-on for up to 7200 seconds since their initial authentication with the IDP (based on value AuthInstance of the Authentication statement). Some IDPs allow users to stay authenticated for longer periods than this and you might need to change the default value by setting maxAuthenticationAge of the WebSSOProfileConsumerImpl bean.

As clocks between IDP and SP machines may not be perfectly synchronized a tolerance of 60 seconds is applied for time comparisons. The tolerance value (time skew) can be customized by settings property responseSkew in beans WebSSOProfileConsumerImpl and SingleLogoutProfileImpl.

The following tables summarize all checks for time validity during processing of incoming SAML messages. Response skew refers to property responseSkew set on profile beans. Past indicates that validity window for checking of the value will be extended by responseSkew seconds to the past and correspondingly with the future value. Nullable values can be missing from the incoming messages.

Support for enhanced client/proxy can be configured using property ecpEnabled of the service provider's extended metadata. Once enabled, ECP profile is automatically activated with requests containing HTTP headers Accept: application/vnd.paos+xml and PAOS: ver='urn:liberty:paos:2003-08'; 'urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp'. Binding used to server ECP profile is always automatically set to PAOS.

ECP can be enabled in combination with the automatic metadata generation using the following settings:

<bean class="org.springframework.security.saml.metadata.MetadataGenerator">
	<property name="extendedMetadata">
		<bean class="org.springframework.security.saml.metadata.ExtendedMetadata">
			<property name="ecpEnabled" value="true"/>
		</bean>
	</property>
</bean>

By default Spring SAML uses the following endpoints, which can optionally also contain information about entity alias of the local Service Provider:

The default URLs can be altered with these steps:

Endpoints of filters samlEntryPoint, samlLogoutFilter and metadataDisplayFilter can be changed using the same process and without need to re-generate the metadata.

Usage of HTTP-Artifact binding requires Spring SAML to make a direct SOAP call to the Identity Provider. Sometimes it's necessary to configure correct HTTP proxy for the call. This can be achieved by setting property hostConfiguration on HttpClient plugged to the artifactBinding bean. The following configuration demonstrates creation of the bean for the hostConfiguration:

<bean id="hostConfiguration" class="org.apache.commons.httpclient.HostConfiguration"/>
<bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
	<property name="targetObject" ref="hostConfiguration"/>
	<property name="targetMethod" value="setProxy"/>
	<property name="arguments">
		<list>
			<value>testHost</value>
			<value>8080</value>
		</list>
	</property>
</bean>

Another common use-case is situation when artifact resolution endpoint at IDP is secured using HTTP-Basic authentication. Authentication can be configured by setting HTTPClient's property state with the following bean:

<bean id="state" class="org.apache.commons.httpclient.HttpState"/>
<bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
	<property name="targetObject" ref="state"/>
	<property name="targetMethod" value="setCredentials"/>
	<property name="arguments">
		<list>
			<util:constant static-field="org.apache.commons.httpclient.auth.AuthScope.ANY"/>
			<bean class="org.apache.commons.httpclient.UsernamePasswordCredentials">
				<constructor-arg value="username"/>
				<constructor-arg value="password"/>
			</bean>
		</list>
	</property>
</bean>