基于 SAML 断言的 SAML2 身份验证和授权

我在用着spring-security-saml2-service-provider针对 SAML IdP 验证我的 SpringBoot Web 应用程序 - 这有效。我还可以使用 REST 控制器访问 SAML 断言@AuthenticationPrincipal Saml2AuthenticatedPrincipal principal，但我想做的是使用 Saml2AuthenticatedPrincipal 主体中的断言内的值来限制 url 的访问 - 这是 SAML 联盟中释放 eduPersonEntitlement 值的常见方法，并据此决定访问。有人这样做过吗？我对此的所有研究/试验都一无所获。 这是我到目前为止所拥有的：

@EnableWebSecurity
public class SAMLSecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
RelyingPartyRegistrationRepository relyingPartyRegistrationRepository;

protected void configure(HttpSecurity http) throws Exception {

    RelyingPartyRegistrationResolver relyingPartyRegistrationResolver =
    new DefaultRelyingPartyRegistrationResolver(this.relyingPartyRegistrationRepository);

    Saml2MetadataFilter filter = new Saml2MetadataFilter(relyingPartyRegistrationResolver, new OpenSamlMetadataResolver());
    
    http
        .saml2Login(withDefaults())
            .addFilterBefore(filter, Saml2WebSsoAuthenticationFilter.class).antMatcher("/**")
        .authorizeRequests()
            .anyRequest().authenticated();
    }
}

我想我需要换掉authenticated()可能与角色有关，并以某种方式在用户登录时为用户设置角色，但对此毫无进展。有任何想法吗？

好的，开始工作了......您需要自定义 saml2Login - 用新的定制器替换 withDefaults() 方法（下面的 Saml2LoginSettings）：

SAMLSecurityconfig.java：

@EnableWebSecurity
public class SAMLSecurityConfig extends WebSecurityConfigurerAdapter {
  
    @Autowired
    RelyingPartyRegistrationRepository relyingPartyRegistrationRepository;

    @Autowired
    Saml2LoginSettings settings;
    
    protected void configure(HttpSecurity http) throws Exception {

        RelyingPartyRegistrationResolver relyingPartyRegistrationResolver =
        new DefaultRelyingPartyRegistrationResolver(this.relyingPartyRegistrationRepository);

        Saml2MetadataFilter filter = new Saml2MetadataFilter(relyingPartyRegistrationResolver, new OpenSamlMetadataResolver());

        http
            .saml2Login(settings)
                .addFilterBefore(filter, Saml2WebSsoAuthenticationFilter.class).antMatcher("/**")  // 
            .authorizeRequests()
            .antMatchers("/attributes").hasAuthority("ADMIN")
            .anyRequest().authenticated();

使用 Saml2LoginSettings.java：

@Component
class Saml2LoginSettings implements Customizer <Saml2LoginConfigurer<HttpSecurity>> {

    @Override
    public void customize(Saml2LoginConfigurer<HttpSecurity> t) {
   
        t.successHandler(new SavedRequestAwareAuthenticationSuccessHandler() {

            @Override
            public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
                    Authentication authentication) throws IOException, ServletException {

                authentication = assignAuthorities (authentication, request);
                super.onAuthenticationSuccess(request, response, authentication);
            }
        }); 
    }

分配权限有点麻烦，但这是有效的：

    private Authentication assignAuthorities (Authentication authentication, HttpServletRequest request) {
        Collection<SimpleGrantedAuthority> oldAuthorities = (Collection<SimpleGrantedAuthority>)SecurityContextHolder.getContext()
                .getAuthentication().getAuthorities();

        DefaultSaml2AuthenticatedPrincipal princ = (DefaultSaml2AuthenticatedPrincipal) authentication.getPrincipal();
        if (princ.getAttribute("urn:oid:1.3.6.1.4.1.5923.1.1.1.7").contains("urn:mace:dir:entitlement:common-lib-terms")) {

            List<SimpleGrantedAuthority> updatedAuthorities = new ArrayList<SimpleGrantedAuthority>();
            updatedAuthorities.addAll(oldAuthorities);
            updatedAuthorities.add(new SimpleGrantedAuthority("ADMIN"));
            Saml2Authentication sAuth = (Saml2Authentication) authentication;

            sAuth = new Saml2Authentication(
                    (AuthenticatedPrincipal) SecurityContextHolder.getContext().getAuthentication().getPrincipal(),
                    sAuth.getSaml2Response(),
                    updatedAuthorities
            );
            SecurityContextHolder.getContext().setAuthentication(sAuth);

            return sAuth;
        }
        else 
            return authentication;
    }

示例代码here https://github.com/jim-reespotter/SpringBootSAML