spring sso代码案例

以下是一个简单的Spring SSO代码案例：

1. 首先，需要在两个应用程序中添加以下依赖项：

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-config</artifactId>
    <version>5.2.2.RELEASE</version>
</dependency>

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-web</artifactId>
    <version>5.2.2.RELEASE</version>
</dependency>

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-saml2-core</artifactId>
    <version>1.0.10.RELEASE</version>
</dependency>

2. 在两个应用程序的Spring配置文件中，配置Spring Security和SAML：

<!-- 应用程序1的配置文件 -->
<bean id="metadata" class="org.springframework.security.saml.metadata.CachingMetadataManager">
    <constructor-arg>
        <list>
            <bean class="org.opensaml.saml2.metadata.provider.HTTPMetadataProvider">
                <constructor-arg value="http://localhost:8081/metadata"/>
                <constructor-arg value="5000"/>
                <property name="parserPool" ref="parserPool"/>
            </bean>
        </list>
    </constructor-arg>
</bean>

<bean id="samlEntryPoint" class="org.springframework.security.saml.SAMLEntryPoint">
    <property name="defaultProfileOptions">
        <bean class="org.springframework.security.saml.websso.WebSSOProfileOptions">
            <property name="includeScoping" value="false"/>
        </bean>
    </property>
</bean>

<bean id="metadataGeneratorFilter" class="org.springframework.security.saml.metadata.MetadataGeneratorFilter">
    <constructor-arg>
        <bean class="org.springframework.security.saml.metadata.CachingMetadataManager">
            <constructor-arg>
                <list>
                    <bean class="org.opensaml.saml2.metadata.provider.HTTPMetadataProvider">
                        <constructor-arg value="http://localhost:8080/metadata"/>
                        <constructor-arg value="5000"/>
                        <property name="parserPool" ref="parserPool"/>
                    </bean>
                </list>
            </constructor-arg>
        </bean>
    </constructor-arg>
</bean>

<bean id="SAMLUserDetailsService" class="com.example.sso.SAMLUserDetailsServiceImpl"/>

<bean id="samlWebSSOFilter" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl">
    <constructor-arg>
        <bean class="org.springframework.security.saml.websso.WebSSOProfileOptions">
            <property name="includeScoping" value="false"/>
        </bean>
    </constructor-arg>
    <property name="userDetailsService" ref="SAMLUserDetailsService"/>
</bean>

<bean id="samlLogoutFilter" class="org.springframework.security.saml.websso.SingleLogoutProfileImpl">
    <property name="ssoLogoutURL" value="http://localhost:8081/logout"/>
</bean>

<bean id="samlLogoutProcessingFilter" class="org.springframework.security.saml.websso.SingleLogoutProfileImpl">
    <constructor-arg>
        <bean class="org.springframework.security.saml.websso.SingleLogoutProfileOptions">
            <property name="requireSignedLogoutMessages" value="false"/>
        </bean>
    </constructor-arg>
</bean>

<security:http entry-point-ref="samlEntryPoint">
    <security:intercept-url pattern="/saml/**" access="IS_AUTHENTICATED_FULLY"/>
    <security:custom-filter before="FIRST" ref="metadataGeneratorFilter"/>
    <security:custom-filter after="BASIC_AUTH_FILTER" ref="samlWebSSOFilter"/>
    <security:custom-filter before="LOGOUT_FILTER" ref="samlLogoutFilter"/>
    <security:custom-filter after="LOGOUT_FILTER" ref="samlLogoutProcessingFilter"/>
</security:http>

<security:authentication-manager>
    <security:authentication-provider ref="SAMLAuthenticationProvider"/>
</security:authentication-manager>

<bean id="SAMLAuthenticationProvider" class="org.springframework.security.saml.SAMLAuthenticationProvider">
    <property name="userDetails" ref="SAMLUserDetailsService"/>
    <property name="forcePrincipalAsString" value="false"/>
</bean>

<!-- 应用程序2的配置文件 -->
<bean id="metadata" class="org.springframework.security.saml.metadata.CachingMetadataManager">
    <constructor-arg>
        <list>
            <bean class="org.opensaml.saml2.metadata.provider.HTTPMetadataProvider">
                <constructor-arg value="http://localhost:8080/metadata"/>
                <constructor-arg value="5000"/>
                <property name="parserPool" ref="parserPool"/>
            </bean>
        </list>
    </constructor-arg>
</bean>

<bean id="samlEntryPoint" class="org.springframework.security.saml.SAMLEntryPoint">
    <property name="defaultProfileOptions">
        <bean class="org.springframework.security.saml.websso.WebSSOProfileOptions">
            <property name="includeScoping" value="false"/>
        </bean>
    </property>
</bean>

<bean id="metadataGeneratorFilter" class="org.springframework.security.saml.metadata.MetadataGeneratorFilter">
    <constructor-arg>
        <bean class="org.springframework.security.saml.metadata.CachingMetadataManager">
            <constructor-arg>
                <list>
                    <bean class="org.opensaml.saml2.metadata.provider.HTTPMetadataProvider">
                        <constructor-arg value="http://localhost:8081/metadata"/>
                        <constructor-arg value="5000"/>
                        <property name="parserPool" ref="parserPool"/>
                    </bean>
                </list>
            </constructor-arg>
        </bean>
    </constructor-arg>
</bean>

<bean id="SAMLUserDetailsService" class="com.example.sso.SAMLUserDetailsServiceImpl"/>

<bean id="samlWebSSOFilter" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl">
    <constructor-arg>
        <bean class="org.springframework.security.saml.websso.WebSSOProfileOptions">
            <property name="includeScoping" value="false"/>
        </bean>
    </constructor-arg>
    <property name="userDetailsService" ref="SAMLUserDetailsService"/>
</bean>

<bean id="samlLogoutFilter" class="org.springframework.security.saml.websso.SingleLogoutProfileImpl">
    <property name="ssoLogoutURL" value="http://localhost:8080/logout"/>
</bean>

<bean id="samlLogoutProcessingFilter" class="org.springframework.security.saml.websso.SingleLogoutProfileImpl">
    <constructor-arg>
        <bean class="org.springframework.security.saml.websso.SingleLogoutProfileOptions">
            <property name="requireSignedLogoutMessages" value="false"/>
        </bean>
    </constructor-arg>
</bean>

<security:http entry-point-ref="samlEntryPoint">
    <security:intercept-url pattern="/saml/**" access="IS_AUTHENTICATED_FULLY"/>
    <security:custom-filter before="FIRST" ref="metadataGeneratorFilter"/>
    <security:custom-filter after="BASIC_AUTH_FILTER" ref="samlWebSSOFilter"/>
    <security:custom-filter before="LOGOUT_FILTER" ref="samlLogoutFilter"/>
    <security:custom-filter after="LOGOUT_FILTER" ref="samlLogoutProcessingFilter"/>
</security:http>

<security:authentication-manager>
    <security:authentication-provider ref="SAMLAuthenticationProvider"/>
</security:authentication-manager>

<bean id="SAMLAuthenticationProvider" class="org.springframework.security.saml.SAMLAuthenticationProvider">
    <property name="userDetails" ref="SAMLUserDetailsService"/>
    <property name="forcePrincipalAsString" value="false"/>
</bean>

3. 创建一个SAMLUserDetailsService实现类：

@Service
public class SAMLUserDetailsServiceImpl implements SAMLUserDetailsService {

    @Override
    public Object loadUserBySAML(SAMLCredential credential) throws UsernameNotFoundException {
        String userId = credential.getNameID().getValue();
        List<GrantedAuthority> authorities = new ArrayList<>();
        authorities.add(new SimpleGrantedAuthority("ROLE_USER"));
        return new User(userId, "", authorities);
    }

}

4. 启动两个应用程序，访问其中一个应用程序的SAML登录页面，然后使用SAML凭据登录。您将被重定向到另一个应用程序，并自动登录。