org.springframework.security.saml2.provider.service.authentication

Class OpenSamlAuthenticationProvider

java.lang.Object

org.springframework.security.saml2.provider.service.authentication.OpenSamlAuthenticationProvider

All Implemented Interfaces:

AuthenticationProvider

public final class OpenSamlAuthenticationProvider
extends java.lang.Object
implements AuthenticationProvider

Implementation of AuthenticationProvider for SAML authentications when receiving a Response object containing an Assertion. This implementation uses the OpenSAML 3 library.

The OpenSamlAuthenticationProvider supports Saml2AuthenticationToken objects that contain a SAML response in its decoded XML format Saml2AuthenticationToken.getSaml2Response() along with the information about the asserting party, the identity provider (IDP), as well as the relying party, the service provider (SP, this application).

The Saml2AuthenticationToken will be processed into a SAML Response object. The SAML response object can be signed. If the Response is signed, a signature will not be required on the assertion.

While a response object can contain a list of assertion, this provider will only leverage the first valid assertion for the purpose of authentication. Assertions that do not pass validation will be ignored. If no valid assertions are found a Saml2AuthenticationException is thrown.

This provider supports two types of encrypted SAML elements

• EncryptedAssertion
• EncryptedID

If the assertion is encrypted, then signature validation on the assertion is no longer required.

This provider does not perform an X509 certificate validation on the configured asserting party, IDP, verification certificates.

Since:

5.2

See Also:

SAML 2 StatusResponse, OpenSAML 3

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	OpenSamlAuthenticationProvider.AssertionToken A tuple containing an OpenSAML Assertion and its associated authentication token.
static class	OpenSamlAuthenticationProvider.ResponseToken A tuple containing an OpenSAML Response and its associated authentication token.

Constructor Summary

Constructors

Constructor and Description
OpenSamlAuthenticationProvider() Creates an OpenSamlAuthenticationProvider

Method Summary

Modifier and Type	Method and Description
Authentication	authenticate(Authentication authentication) Performs authentication with the same contract as AuthenticationManager.authenticate(Authentication) .
static org.springframework.core.convert.converter.Converter<OpenSamlAuthenticationProvider.AssertionToken,Saml2ResponseValidatorResult>	createDefaultAssertionValidator() Construct a default strategy for validating each SAML 2.0 Assertion and associated Authentication token
static org.springframework.core.convert.converter.Converter<OpenSamlAuthenticationProvider.AssertionToken,Saml2ResponseValidatorResult>	createDefaultAssertionValidator(org.springframework.core.convert.converter.Converter<OpenSamlAuthenticationProvider.AssertionToken,org.opensaml.saml.common.assertion.ValidationContext> contextConverter) Construct a default strategy for validating each SAML 2.0 Assertion and associated Authentication token
static org.springframework.core.convert.converter.Converter<OpenSamlAuthenticationProvider.ResponseToken,Saml2Authentication>	createDefaultResponseAuthenticationConverter() Construct a default strategy for converting a SAML 2.0 Response and Authentication token into a Saml2Authentication
void	setAssertionValidator(org.springframework.core.convert.converter.Converter<OpenSamlAuthenticationProvider.AssertionToken,Saml2ResponseValidatorResult> assertionValidator) Set the Converter to use for validating each Assertion in the SAML 2.0 Response.
void	setAuthoritiesExtractor(org.springframework.core.convert.converter.Converter<org.opensaml.saml.saml2.core.Assertion,java.util.Collection<? extends GrantedAuthority>> authoritiesExtractor) Deprecated. Use setResponseAuthenticationConverter(Converter) instead
void	setAuthoritiesMapper(GrantedAuthoritiesMapper authoritiesMapper) Deprecated. Use setResponseAuthenticationConverter(Converter) instead
void	setResponseAuthenticationConverter(org.springframework.core.convert.converter.Converter<OpenSamlAuthenticationProvider.ResponseToken,? extends AbstractAuthenticationToken> responseAuthenticationConverter) Set the Converter to use for converting a validated Response into an AbstractAuthenticationToken.
void	setResponseTimeValidationSkew(java.time.Duration responseTimeValidationSkew) Deprecated. Use setAssertionValidator(Converter) instead
boolean	supports(java.lang.Class<?> authentication) Returns true if this AuthenticationProvider supports the indicated Authentication object.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

OpenSamlAuthenticationProvider

public OpenSamlAuthenticationProvider()

Creates an OpenSamlAuthenticationProvider

Method Detail

setAssertionValidator

public void setAssertionValidator(org.springframework.core.convert.converter.Converter<OpenSamlAuthenticationProvider.AssertionToken,Saml2ResponseValidatorResult> assertionValidator)

Set the Converter to use for validating each Assertion in the SAML 2.0 Response. You can still invoke the default validator by delgating to createDefaultAssertionValidator(), like so:

        OpenSamlAuthenticationProvider provider = new OpenSamlAuthenticationProvider();
  provider.setAssertionValidator(assertionToken -> {
                Saml2ResponseValidatorResult result = createDefaultAssertionValidator()
                        .convert(assertionToken)
                return result.concat(myCustomValidator.convert(assertionToken));
  });
 

You can also use this method to configure the provider to use a different ValidationContext from the default, like so:

        OpenSamlAuthenticationProvider provider = new OpenSamlAuthenticationProvider();
        provider.setAssertionValidator(
                createDefaultAssertionValidator(assertionToken -> {
                        Map<String, Object> params = new HashMap<>();
                        params.put(CLOCK_SKEW, 2 * 60 * 1000);
                        // other parameters
                        return new ValidationContext(params);
                }));
 

Consider taking a look at createValidationContext(org.springframework.security.saml2.provider.service.authentication.OpenSamlAuthenticationProvider.AssertionToken, java.util.function.Consumer<java.util.Map<java.lang.String, java.lang.Object>>) to see how it constructs a ValidationContext. It is not necessary to delegate to the default validator. You can safely replace it entirely with your own. Note that signature verification is performed as a separate step from this validator. This method takes precedence over setResponseTimeValidationSkew(java.time.Duration).

Parameters:

assertionValidator -

Since:

5.4

setResponseAuthenticationConverter

public void setResponseAuthenticationConverter(org.springframework.core.convert.converter.Converter<OpenSamlAuthenticationProvider.ResponseToken,? extends AbstractAuthenticationToken> responseAuthenticationConverter)

Set the Converter to use for converting a validated Response into an AbstractAuthenticationToken. You can delegate to the default behavior by calling createDefaultResponseAuthenticationConverter() like so:

        OpenSamlAuthenticationProvider provider = new OpenSamlAuthenticationProvider();
        Converter<ResponseToken, Saml2Authentication> authenticationConverter =
                        createDefaultResponseAuthenticationConverter();
        provider.setResponseAuthenticationConverter(responseToken -> {
                Saml2Authentication authentication = authenticationConverter.convert(responseToken);
                User user = myUserRepository.findByUsername(authentication.getName());
                return new MyAuthentication(authentication, user);
        });
 

This method takes precedence over setAuthoritiesExtractor(Converter) and setAuthoritiesMapper(GrantedAuthoritiesMapper).

Parameters:

responseAuthenticationConverter - the Converter to use

Since:

5.4

setAuthoritiesExtractor

public void setAuthoritiesExtractor(org.springframework.core.convert.converter.Converter<org.opensaml.saml.saml2.core.Assertion,java.util.Collection<? extends GrantedAuthority>> authoritiesExtractor)

Deprecated. Use setResponseAuthenticationConverter(Converter) instead

Sets the Converter used for extracting assertion attributes that can be mapped to authorities.

Parameters:

authoritiesExtractor - the Converter used for mapping the assertion attributes to authorities

setAuthoritiesMapper

public void setAuthoritiesMapper(GrantedAuthoritiesMapper authoritiesMapper)

Deprecated. Use setResponseAuthenticationConverter(Converter) instead

Sets the GrantedAuthoritiesMapper used for mapping assertion attributes to a new set of authorities which will be associated to the Saml2Authentication. Note: This implementation is only retrieving

Parameters:

authoritiesMapper - the GrantedAuthoritiesMapper used for mapping the user's authorities

setResponseTimeValidationSkew

public void setResponseTimeValidationSkew(java.time.Duration responseTimeValidationSkew)

Deprecated. Use setAssertionValidator(Converter) instead

Sets the duration for how much time skew an assertion may tolerate during timestamp, NotOnOrBefore and NotOnOrAfter, validation.

Parameters:

responseTimeValidationSkew - duration for skew tolerance

createDefaultAssertionValidator

public static org.springframework.core.convert.converter.Converter<OpenSamlAuthenticationProvider.AssertionToken,Saml2ResponseValidatorResult> createDefaultAssertionValidator()

Construct a default strategy for validating each SAML 2.0 Assertion and associated Authentication token

Returns:

the default assertion validator strategy

Since:

5.4

createDefaultAssertionValidator

public static org.springframework.core.convert.converter.Converter<OpenSamlAuthenticationProvider.AssertionToken,Saml2ResponseValidatorResult> createDefaultAssertionValidator(org.springframework.core.convert.converter.Converter<OpenSamlAuthenticationProvider.AssertionToken,org.opensaml.saml.common.assertion.ValidationContext> contextConverter)

Construct a default strategy for validating each SAML 2.0 Assertion and associated Authentication token

Parameters:

contextConverter - the conversion strategy to use to generate a ValidationContext for each assertion being validated

Returns:

the default assertion validator strategy

Since:

5.4

createDefaultResponseAuthenticationConverter

public static org.springframework.core.convert.converter.Converter<OpenSamlAuthenticationProvider.ResponseToken,Saml2Authentication> createDefaultResponseAuthenticationConverter()

Construct a default strategy for converting a SAML 2.0 Response and Authentication token into a Saml2Authentication

Returns:

the default response authentication converter strategy

Since:

5.4

authenticate

public Authentication authenticate(Authentication authentication)
                            throws AuthenticationException

Description copied from interface: AuthenticationProvider

Performs authentication with the same contract as AuthenticationManager.authenticate(Authentication) .

Specified by:

authenticate in interface AuthenticationProvider

Parameters:

authentication - the authentication request object, must be of type Saml2AuthenticationToken

Returns:

Saml2Authentication if the assertion is valid

Throws:

AuthenticationException - if a validation exception occurs

supports

public boolean supports(java.lang.Class<?> authentication)

Description copied from interface: AuthenticationProvider

Returns true if this AuthenticationProvider supports the indicated Authentication object.

Returning true does not guarantee an AuthenticationProvider will be able to authenticate the presented instance of the Authentication class. It simply indicates it can support closer evaluation of it. An AuthenticationProvider can still return null from the AuthenticationProvider.authenticate(Authentication) method to indicate another AuthenticationProvider should be tried.

Selection of an AuthenticationProvider capable of performing authentication is conducted at runtime the ProviderManager.

Specified by:

supports in interface AuthenticationProvider

Returns:

true if the implementation can more closely evaluate the Authentication class presented