spring security SecurityFilterChain saml

Question

挑战：具有 saml 集成的工作应用程序（SB 2.7.8），但 WebSecurityConfigurer Adapter 的实现应更新到 Spring Boot 3/Vaadin 24。所以我必须首先摆脱 WebSecurityConfigurer Adapter。 一段时间后，我成功达到了登录级别 6 (https://docs.spring.io/spring-security/reference/servlet/saml2/login/index.html)。我返回我的应用程序，但收到 403。 我的IDP是F5，我在公司网络内部，它授权的是对http://localhost:8080/"myAppName"的saml访问。 Vaadin 提供了一个用 @Route(value ="") 定义的登陆视图，并且在“旧”实现中一切正常。由于 F5 使用默认值拒绝了我的请求，因此我添加了实体 ID 和断言消费者服务位置，就像旧实现中一样。因此，授权后的请求被路由到 localhost:8080/"myAppName"/saml/SSO，我得到 403。这就是为什么我认为我的过滤可以更好:)。

到目前为止的新代码：

@Bean
SecurityFilterChain app(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests((authorize) -> authorize
        .anyRequest().authenticated()
    )
    .saml2Login(Customizer.withDefaults());
    return http.build();
}

@Bean
RelyingPartyRegistrationResolver relyingPartyRegistrationResolver(
    RelyingPartyRegistrationRepository registrations) {
    return new DefaultRelyingPartyRegistrationResolver((id) -> registrations.findByRegistrationId("core2"));
}


@Bean
RelyingPartyRegistrationRepository repository() {
    RelyingPartyRegistration core2 = RelyingPartyRegistrations
    .fromMetadataLocation(idpMetadataURL)
    .entityId(entityId) 
    .assertionConsumerServiceLocation(acsLocation) 
    .registrationId("core2")
    .build();
return new InMemoryRelyingPartyRegistrationRepository(core2);
}

---

添加像 .antMatchers("/saml/**).permitAll 这样的 ant 匹配器不会改变任何事情。

旧代码更长，我必须同样如何将旧代码的路由转换为新的实现；另外，我不太明白它是如何工作的，但我想答案就在里面。 任何形式的帮助将不胜感激。

旧代码：

de.xxx.xxx.xxx.security;

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import java.io.File;
import java.io.IOException;
import java.util.ArrayList;
import java.util.Collection;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Timer;

import org.apache.commons.httpclient.HostConfiguration;

import org.apache.commons.httpclient.HttpClient;
import org.apache.commons.httpclient.MultiThreadedHttpConnectionManager;
import org.apache.velocity.app.VelocityEngine;
import org.opensaml.saml2.metadata.provider.FilesystemMetadataProvider;
import org.opensaml.saml2.metadata.provider.MetadataProvider;
import org.opensaml.saml2.metadata.provider.MetadataProviderException;
import org.opensaml.xml.parse.ParserPool;
import org.opensaml.xml.parse.StaticBasicParserPool;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.beans.factory.DisposableBean;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.context.annotation.Bean;
import org.springframework.core.io.DefaultResourceLoader;
import org.springframework.core.io.Resource;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.saml.SAMLAuthenticationProvider;
import org.springframework.security.saml.SAMLBootstrap;
import org.springframework.security.saml.SAMLDiscovery;
import org.springframework.security.saml.SAMLEntryPoint;
import org.springframework.security.saml.SAMLLogoutFilter;
import org.springframework.security.saml.SAMLLogoutProcessingFilter;
import org.springframework.security.saml.SAMLProcessingFilter;
import org.springframework.security.saml.SAMLWebSSOHoKProcessingFilter;
import org.springframework.security.saml.context.SAMLContextProviderImpl;
import org.springframework.security.saml.key.JKSKeyManager;
import org.springframework.security.saml.key.KeyManager;
import org.springframework.security.saml.log.SAMLDefaultLogger;
import org.springframework.security.saml.metadata.CachingMetadataManager;
import org.springframework.security.saml.metadata.ExtendedMetadata;
import org.springframework.security.saml.metadata.ExtendedMetadataDelegate;
import org.springframework.security.saml.metadata.MetadataDisplayFilter;
import org.springframework.security.saml.metadata.MetadataGenerator;
import org.springframework.security.saml.metadata.MetadataGeneratorFilter;
import org.springframework.security.saml.parser.ParserPoolHolder;
import org.springframework.security.saml.processor.HTTPArtifactBinding;
import org.springframework.security.saml.processor.HTTPPAOS11Binding;
import org.springframework.security.saml.processor.HTTPPostBinding;
import org.springframework.security.saml.processor.HTTPRedirectDeflateBinding;
import org.springframework.security.saml.processor.HTTPSOAP11Binding;
import org.springframework.security.saml.processor.SAMLBinding;
import org.springframework.security.saml.processor.SAMLProcessorImpl;
import org.springframework.security.saml.util.VelocityFactory;
import org.springframework.security.saml.websso.ArtifactResolutionProfile;
import org.springframework.security.saml.websso.ArtifactResolutionProfileImpl;
import org.springframework.security.saml.websso.SingleLogoutProfile;
import org.springframework.security.saml.websso.SingleLogoutProfileImpl;
import org.springframework.security.saml.websso.WebSSOProfile;
import org.springframework.security.saml.websso.WebSSOProfileConsumer;
import org.springframework.security.saml.websso.WebSSOProfileConsumerHoKImpl;
import org.springframework.security.saml.websso.WebSSOProfileConsumerImpl;
import org.springframework.security.saml.websso.WebSSOProfileECPImpl;
import org.springframework.security.saml.websso.WebSSOProfileImpl;
import org.springframework.security.saml.websso.WebSSOProfileOptions;
import org.springframework.security.web.DefaultSecurityFilterChain;
import org.springframework.security.web.FilterChainProxy;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.access.channel.ChannelProcessingFilter;
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
import org.springframework.security.web.authentication.logout.LogoutHandler;
import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
import org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
import org.springframework.security.web.csrf.CsrfFilter;

import org.springframework.security.web.util.matcher.AntPathRequestMatcher;


@EnableWebSecurity
@Configuration
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true, proxyTargetClass = true)
public class SAMLWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter implements InitializingBean, DisposableBean{
   

       @Value("${saml.idpURL}")
       private String idpMetadataURL;      

       @Value("${saml.signing}")
       private String signingAlgorithm;
       
       @Value("${saml.entityid}")
       private String entityId;
      
       @Value("${saml.keystore}")
       String keystore;
       
       @Value("${saml.keystore.storepass}")
       String storePass;
       
       @Value("${saml.keystore.defaultkey}")
       String defaultKey;

       private Timer backgroundTaskTimer;
       private MultiThreadedHttpConnectionManager multiThreadedHttpConnectionManager;

        public void init() {
            this.backgroundTaskTimer = new Timer(true);
            this.multiThreadedHttpConnectionManager = new MultiThreadedHttpConnectionManager();
        }

        public void shutdown() {
            this.backgroundTaskTimer.purge();
            this.backgroundTaskTimer.cancel();
            this.multiThreadedHttpConnectionManager.shutdown();
        }

        //private SAMLUserDetailsServiceImpl samlUserDetailsServiceImpl;

        // Initialization of the velocity engine

        @Bean
        public VelocityEngine velocityEngine() {
            return VelocityFactory.getEngine();
        }

        // XML parser pool needed for OpenSAML parsing
        @Bean(initMethod = "initialize")
        public StaticBasicParserPool parserPool() {
            return new StaticBasicParserPool();
        }

        @Bean(name = "parserPoolHolder")
        public ParserPoolHolder parserPoolHolder() {
            return new ParserPoolHolder();
        }

        // SAML Authentication Provider responsible for validating of received SAML
        // messages
        @Bean
        public SAMLAuthenticationProvider samlAuthenticationProvider() {
            SAMLAuthenticationProvider samlAuthenticationProvider = new SAMLAuthenticationProvider();
            //samlAuthenticationProvider.setUserDetails(samlUserDetailsServiceImpl);
            samlAuthenticationProvider.setForcePrincipalAsString(true);
            return samlAuthenticationProvider;
        }

        // Provider of default SAML Context

        @Bean
        public SAMLContextProviderImpl contextProvider() {
            return new SAMLContextProviderImpl();
        }

        // Initialization of OpenSAML library
        @Bean
        public static SAMLBootstrap sAMLBootstrap() {
            return new SAMLBootstrap();
        }

        // Logger for SAML messages and events
        @Bean
        public SAMLDefaultLogger samlLogger() {
            return new SAMLDefaultLogger();
        }

        // SAML 2.0 WebSSO Assertion Consumer
        @Bean
        public WebSSOProfileConsumer webSSOprofileConsumer() {
            return new WebSSOProfileConsumerImpl();
        }
        
        // SAML 2.0 Holder-of-Key WebSSO Assertion Consumer
        @Bean
        public WebSSOProfileConsumerHoKImpl hokWebSSOprofileConsumer() {
            return new WebSSOProfileConsumerHoKImpl();
        }

        // SAML 2.0 Web SSO profile
        @Bean
        public WebSSOProfile webSSOprofile() {
            return new WebSSOProfileImpl();
        }

        // SAML 2.0 Holder-of-Key Web SSO profile

        @Bean
        public WebSSOProfileConsumerHoKImpl hokWebSSOProfile() {
            return new WebSSOProfileConsumerHoKImpl();
        }

        // SAML 2.0 ECP profile
        @Bean
        public WebSSOProfileECPImpl ecpprofile() {
            return new WebSSOProfileECPImpl();
        }

        @Bean
        public SingleLogoutProfile logoutprofile() {
            return new SingleLogoutProfileImpl();
        }

        // Central storage of cryptographic keys
        @Bean
        public KeyManager keyManager() {
            DefaultResourceLoader loader = new DefaultResourceLoader();
            Resource storeFile = loader
                    .getResource(keystore);
            Map<String, String> passwords = new HashMap<String, String>();          
            passwords.put(defaultKey, storePass);
            return new JKSKeyManager(storeFile, storePass, passwords, defaultKey);
        }

        @Bean
        public WebSSOProfileOptions defaultWebSSOProfileOptions() {
            WebSSOProfileOptions webSSOProfileOptions = new WebSSOProfileOptions();
            webSSOProfileOptions.setIncludeScoping(false);
            return webSSOProfileOptions;
        }

        // Entry point to initialize authentication, default values taken from
        // properties file

        @Bean
        public SAMLEntryPoint samlEntryPoint() {
            SAMLEntryPoint samlEntryPoint = new SAMLEntryPoint();
            samlEntryPoint.setDefaultProfileOptions(defaultWebSSOProfileOptions());
            return samlEntryPoint;
        }

        // Setup advanced info about metadata
        @Bean
        public ExtendedMetadata extendedMetadata() {
            ExtendedMetadata extendedMetadata = new ExtendedMetadata();
            extendedMetadata.setIdpDiscoveryEnabled(false);
            extendedMetadata.setSigningAlgorithm(signingAlgorithm);
            extendedMetadata.setSignMetadata(true);
            extendedMetadata.setEcpEnabled(true);
            return extendedMetadata;
        }

        // IDP Discovery Service

        @Bean
        public SAMLDiscovery samlIDPDiscovery() {
            SAMLDiscovery idpDiscovery = new SAMLDiscovery();
            //idpDiscovery.setIdpSelectionPath("/saml/discovery");
            return idpDiscovery;
        }

        @Bean
        @Qualifier("idp-ssocircle")
        public ExtendedMetadataDelegate ssoCircleExtendedMetadataProvider()
                throws MetadataProviderException {
            DefaultResourceLoader loader = new DefaultResourceLoader();
            Resource storeFile = loader
                    .getResource(idpMetadataURL);
            File metadata = null;
            
            try {
                metadata = storeFile.getFile();
            }catch (IOException ex) {
                System.out.println(ex.getMessage());
                return null;
            }
            
            FilesystemMetadataProvider fsMetadataProvider = new FilesystemMetadataProvider(metadata);
            
            fsMetadataProvider.setParserPool(parserPool());
            ExtendedMetadataDelegate extendedMetadataDelegate =
                    new ExtendedMetadataDelegate(fsMetadataProvider, extendedMetadata());
            extendedMetadataDelegate.setMetadataTrustCheck(true);
            extendedMetadataDelegate.setMetadataRequireSignature(false);
            backgroundTaskTimer.purge();
            return extendedMetadataDelegate;
        }

        // IDP Metadata configuration - paths to metadata of IDPs in circle of trust
        // is here
        // Do no forget to call iniitalize method on providers

        @Bean
        @Qualifier("metadata")
        public CachingMetadataManager metadata() throws MetadataProviderException {
            List<MetadataProvider> providers = new ArrayList<MetadataProvider>();
            providers.add(ssoCircleExtendedMetadataProvider());
            return new CachingMetadataManager(providers);
        }

        // Filter automatically generates default SP metadata
        @Bean
        public MetadataGenerator metadataGenerator() {
            MetadataGenerator metadataGenerator = new MetadataGenerator();
            metadataGenerator.setEntityId(entityId);
            metadataGenerator.setExtendedMetadata(extendedMetadata());
            metadataGenerator.setIncludeDiscoveryExtension(false);
            metadataGenerator.setKeyManager(keyManager());
            return metadataGenerator;

        }

        // The filter is waiting for connections on URL suffixed with filterSuffix
        // and presents SP metadata there
        @Bean
        public MetadataDisplayFilter metadataDisplayFilter() {
            return new MetadataDisplayFilter();
        }

        // Handler deciding where to redirect user after successful login
        @Bean
        public SavedRequestAwareAuthenticationSuccessHandler successRedirectHandler() {
            SavedRequestAwareAuthenticationSuccessHandler successRedirectHandler =
                    new SavedRequestAwareAuthenticationSuccessHandler();
            successRedirectHandler.setDefaultTargetUrl("/");
            return successRedirectHandler;
        }

        // Handler deciding where to redirect user after failed login
        @Bean
        public SimpleUrlAuthenticationFailureHandler authenticationFailureHandler() {
            SimpleUrlAuthenticationFailureHandler failureHandler =
                    new SimpleUrlAuthenticationFailureHandler();
            failureHandler.setUseForward(true);
            failureHandler.setDefaultFailureUrl("/error");
            return failureHandler;
        }

        @Bean
        public SAMLWebSSOHoKProcessingFilter samlWebSSOHoKProcessingFilter() throws Exception {
            SAMLWebSSOHoKProcessingFilter samlWebSSOHoKProcessingFilter = new SAMLWebSSOHoKProcessingFilter();
            samlWebSSOHoKProcessingFilter.setAuthenticationSuccessHandler(successRedirectHandler());
            samlWebSSOHoKProcessingFilter.setAuthenticationManager(authenticationManager());
            samlWebSSOHoKProcessingFilter.setAuthenticationFailureHandler(authenticationFailureHandler());
            return samlWebSSOHoKProcessingFilter;
        }

        // Processing filter for WebSSO profile messages
        @Bean
        public SAMLProcessingFilter samlWebSSOProcessingFilter() throws Exception {
            SAMLProcessingFilter samlWebSSOProcessingFilter = new SAMLProcessingFilter();
            samlWebSSOProcessingFilter.setAuthenticationManager(authenticationManager());
            samlWebSSOProcessingFilter.setAuthenticationSuccessHandler(successRedirectHandler());
            samlWebSSOProcessingFilter.setAuthenticationFailureHandler(authenticationFailureHandler());
            return samlWebSSOProcessingFilter;
        }

        @Bean
        public MetadataGeneratorFilter metadataGeneratorFilter() {
            return new MetadataGeneratorFilter(metadataGenerator());
        }

        // Handler for successful logout
        @Bean
        public SimpleUrlLogoutSuccessHandler successLogoutHandler() {
            SimpleUrlLogoutSuccessHandler successLogoutHandler = new SimpleUrlLogoutSuccessHandler();
            successLogoutHandler.setDefaultTargetUrl("/");
            return successLogoutHandler;

        }

        // Logout handler terminating local session
        @Bean

        public SecurityContextLogoutHandler logoutHandler() {
            SecurityContextLogoutHandler logoutHandler =

                    new SecurityContextLogoutHandler();
            logoutHandler.setInvalidateHttpSession(true);
            logoutHandler.setClearAuthentication(true);
            return logoutHandler;
        }

        // Filter processing incoming logout messages
        // First argument determines URL user will be redirected to after successful
        // global logout

        @Bean
        public SAMLLogoutProcessingFilter samlLogoutProcessingFilter() {
            return new SAMLLogoutProcessingFilter(successLogoutHandler(),
                    logoutHandler());
        }

        // Overrides default logout processing filter with the one processing SAML
        // messages
        @Bean
        public SAMLLogoutFilter samlLogoutFilter() {

            return new SAMLLogoutFilter(successLogoutHandler(),
                    new LogoutHandler[] { logoutHandler() },
                    new LogoutHandler[] { logoutHandler() });
        }

        // Bindings

        private ArtifactResolutionProfile artifactResolutionProfile() {
            HttpClient client = new HttpClient(this.multiThreadedHttpConnectionManager);
            final ArtifactResolutionProfileImpl artifactResolutionProfile =
                    new ArtifactResolutionProfileImpl(client);

            artifactResolutionProfile.setProcessor(new SAMLProcessorImpl(soapBinding()));
            return artifactResolutionProfile;

        }

        @Bean
        public HTTPArtifactBinding artifactBinding(ParserPool parserPool, VelocityEngine velocityEngine) {

            return new HTTPArtifactBinding(parserPool, velocityEngine, artifactResolutionProfile());

        }

        @Bean

        public HTTPSOAP11Binding soapBinding() {

            return new HTTPSOAP11Binding(parserPool());

        }

        @Bean

        public HTTPPostBinding httpPostBinding() {
            return new HTTPPostBinding(parserPool(), velocityEngine());

        }

        @Bean

        public HTTPRedirectDeflateBinding httpRedirectDeflateBinding() {
            return new HTTPRedirectDeflateBinding(parserPool());
        }

        @Bean

        public HTTPSOAP11Binding httpSOAP11Binding() {
               return new HTTPSOAP11Binding(parserPool());

    }

    @Bean

    public HTTPPAOS11Binding httpPAOS11Binding() {
             return new HTTPPAOS11Binding(parserPool());
    } 

    // Processor

       @Bean
       public SAMLProcessorImpl processor() {

             Collection<SAMLBinding> bindings = new ArrayList<SAMLBinding>();
             bindings.add(httpRedirectDeflateBinding());
             bindings.add(httpPostBinding());
             bindings.add(artifactBinding(parserPool(), velocityEngine()));
             bindings.add(httpSOAP11Binding());
             bindings.add(httpPAOS11Binding());
             return new SAMLProcessorImpl(bindings);

       }

   

       /**

       * Define the security filter chain in order to support SSO Auth by using SAML 2.0
       *
       * @return Filter chain proxy
       * @throws Exception
       */

    @Bean

    public FilterChainProxy samlFilter() throws Exception {

        List<SecurityFilterChain> chains = new ArrayList<SecurityFilterChain>();
        chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/login/**"),
                samlEntryPoint()));
        chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/logout/**"),
                samlLogoutFilter()));
        chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/metadata/**"),
                metadataDisplayFilter()));
        chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/SSO/**"),
                samlWebSSOProcessingFilter()));
        chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/SSOHoK/**"),
                samlWebSSOHoKProcessingFilter()));
        chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/SingleLogout/**"),
                samlLogoutProcessingFilter()));
        return new FilterChainProxy(chains);
    }

    

    /**

     * Returns the authentication manager currently used by Spring.
     * It represents a bean definition with the aim allow wiring from
     * other classes performing the Inversion of Control (IoC).
     *
     * @throws  Exception
     */
    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    

    /**
     * Defines the web based security configuration.
     *
     * @param   http It allows configuring web based security for specific http requests.
     * @throws  Exception
     */
    @Override 
    protected void configure(HttpSecurity http) throws Exception {
       http.csrf().disable();
        http
            .httpBasic()
                .authenticationEntryPoint(samlEntryPoint());     
        http
                    .addFilterBefore(metadataGeneratorFilter(), ChannelProcessingFilter.class)
                    .addFilterAfter(samlFilter(), BasicAuthenticationFilter.class)
                    .addFilterBefore(samlFilter(), CsrfFilter.class);
        http       
            .authorizeRequests()
                    .antMatchers("/saml/**").permitAll()
                    .antMatchers("/css/**").permitAll()
                    .antMatchers("/img/**").permitAll()
                    .antMatchers("/js/**").permitAll()
                    .anyRequest().authenticated();
        http
                    .logout()
                           .disable();  // The logout procedure is already handled by SAML filters.
    }

   

       /**

       * Allows access to static resources, bypassing Spring security.

       */

       @Override
       public void configure(WebSecurity web) throws Exception {
             web.ignoring().antMatchers(

                           // Vaadin Flow static resources //
                           "/VAADIN/**",

                           // the standard favicon URI
                           "/favicon.ico",

                           // the robots exclusion standard
                           "/robots.txt",

                           // web application manifest //
                           "/manifest.webmanifest", "/sw.js", "/offline-page.html",

                           // (development mode) static resources //
                           "/frontend/**",

                           // (development mode) webjars //
                           "/webjars/**",

                           // (production mode) static resources //
                           "/frontend-es5/**", "/frontend-es6/**",
 

             // web application manifest
             "/manifest.webmanifest",
             "/sw.js",
             "/offline-page.html",

             // (development mode) H2 debugging console
             "/h2-console/**",

             // icons and images
             "/icons/**",
             "/images/**");

       }


    /**

     * Sets a custom authentication provider.
     *
     * @param   auth SecurityBuilder used to create an AuthenticationManager.
     * @throws  Exception
     */

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .authenticationProvider(samlAuthenticationProvider());
    }

    @Override
    public void afterPropertiesSet() throws Exception {
        init();
    }

    @Override
    public void destroy() throws Exception {
        shutdown();
    } 

}

Answer 1

问题解决了吗？注销怎么样，它运行良好>