SAML2 customizable URLs

[JoakimLofgren]

Expected Behavior

I want to be able to change all SAML2 URLs to be able to e.g. add a prefix.

Current Behavior

Some URLs are customizable, like Saml2LoginConfigurer.loginProcessingUrl.
While some are not, e.g. Saml2LoginConfigurer.AuthenticationRequestEndpointConfig.filterProcessingUrl (/saml2/authenticate/{registrationId}).

Context

A workaround for adding a path prefix is using the server.servlet.context-path.
But this doesn't work if you want to tweak URLs to be similar to an already existing solution created with the old SAML module.

Although assuming you want /auth as a prefix, and after login you want to redirect to the root / and not /auth/,
you cannot use the default success handler. You need to create a custom one with a redirect strategy which is not context relative.

[jzheaux]

@JoakimLofgren I think it makes sense to simplify configuring the URL for creating an AuthnRequest.

If we follow the pattern established in OAuth2LoginConfigurer, I think most decisions will be fairly straightforward. For example, it would be nice to do:

http
    .saml2Login(saml2 -> saml2
        .authenticationRequestEndpoint(authn -> authn
            .baseUri(myCustomUri)
        )
    );

Then that would be quite similar to:

http
    .oauth2Login(oauth2 -> oauth2
        .authorizationEndpoint(authz -> authz
            .baseUri(myCustomUri)
        )
    );

Would you be able to submit a PR along those lines to enhance the DSL? It would also be quite nice to update the Kotlin DSL while you are at it.

[JoakimLofgren]

Sure. After #8864 is finished.

[jzheaux]

After a bit more experimentation with it, I think the following is easier to read:

http
    .saml2Login(saml2 -> saml2
        .loginProcessingUrl("/saml2/response/{registrationId}")
        .authenticationRequestUri("/saml2/request/{registrationId}")
    );

I like it because it has less hierarchy.

[jzheaux]

@JoakimLofgren are you still able to contribute a PR to add support for configuring the Saml2WebSsoAuthenticationRequestFilter URI?

[chelseakohli]

Hey, I am kind of stuck on being not able to change default entityId & replyUrl in AuthRequest. My SP is running on http, so the urls for entityId & replyUrl are being generated for http. But by making some firewall changes, publicly website access is only by https. So basically I want the urls in AuthRequest to be https.

[jzheaux]

@chelseakohli, this would probably be better as a StackOverflow question, so please consider posting there if my answer here doesn't address your question and also update your comment with the StackOverflow link.

You can customize the AuthnRequest by configuring the OpenSamlAuthenticationRequestFactory:

@Bean 
Saml2AuthenticationRequestFactory authenticationRequestFactory() {
    OpenSamlAuthenticationRequestFactory factory =
            new OpenSamlAuthenticationRequestFactory();
    factory.setAuthenticationRequestContextConverter((context) -> {
        // construct the AuthnRequest
    });
}

[fr2lancer]

Hi.

Is any updates on this? Seems like the suggestions above hasn't been applied to 5.6.0-RC yet..

Any workaround on this ?(e.g. using withObjectPostProcessor ?)

Thank you.

[denis111]

@fr2lancer
I had to use reflection and ObjectPostProcessor for workaround inside configure(http) method:

Field parent = ReflectionUtils.findField(saml.getClass(), "authenticationRequestEndpoint");
      parent.setAccessible(true);
      Field child = ReflectionUtils.findField(parent.getType(), "filterProcessingUrl");
      child.setAccessible(true);
      ReflectionUtils.setField(child, ReflectionUtils.getField(parent, saml),
          SAML_PATH + "/login");
      parent.setAccessible(false);
      child.setAccessible(false);
      saml.addObjectPostProcessor(
          new ObjectPostProcessor<Saml2WebSsoAuthenticationRequestFilter>() {
            @Override
            public <O extends Saml2WebSsoAuthenticationRequestFilter> O postProcess(O object) {
              object.setRedirectMatcher(new AntPathRequestMatcher(SAML_PATH + "/login"));
              return object;
            }
          });

[denis111]

Could we also have this fields customizable?

private final RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

Because we want to make logout requests by ajax post and JS can't control 302 redirects.

[jzheaux]

@denis111 please log a separate issue regarding customizing the redirect strategy.

[bramhaag]

Any progress?

[jzheaux]

While some are not, e.g. Saml2LoginConfigurer.AuthenticationRequestEndpointConfig.filterProcessingUrl (/saml2/authenticate/{registrationId})

@JoakimLofgren, I've created #10840 to specifically address the authentication request URI. Are there any other endpoints that you would like to see addressed? If not, I'll close this issue in favor of #10840.

[spring-projects-issues]

If you would like us to look at this issue, please provide the requested information. If the information is not provided within the next 7 days this issue will be closed.

[JoakimLofgren]

Sounds good. 👍