springboot集成saml2.0 代码示例 包含IDP SP

以下是Spring Boot集成SAML 2.0的示例代码，包含IDP和SP。

1. 添加依赖

在pom.xml文件中添加以下依赖：

<dependency>
    <groupId>org.springframework.security.extensions</groupId>
    <artifactId>spring-security-saml2-core</artifactId>
    <version>1.0.10.RELEASE</version>
</dependency>

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-config</artifactId>
</dependency>

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-saml2-service</artifactId>
    <version>1.0.10.RELEASE</version>
</dependency>

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-saml2-core</artifactId>
    <version>1.0.10.RELEASE</version>
</dependency>

2. 配置SP

在application.properties文件中添加以下配置：

# SP配置
saml.sp.entityId=sp-entity-id
saml.sp.assertionConsumerServiceURL=http://localhost:8080/saml/SSO
saml.sp.credential.name=sp-credential-name
saml.sp.credential.password=sp-credential-password
saml.sp.keyStore.location=classpath:sp.jks
saml.sp.keyStore.password=sp-jks-password
saml.sp.keyStore.key.password=sp-jks-key-password
saml.sp.keyStore.alias=sp-jks-alias

3. 配置IDP

在application.properties文件中添加以下配置：

# IDP配置
saml.idp.metadataURL=idp-metadata-url
saml.idp.entityId=idp-entity-id
saml.idp.singleSignOnServiceURL=idp-single-sign-on-service-url
saml.idp.singleLogoutServiceURL=idp-single-logout-service-url
saml.idp.credential.name=idp-credential-name
saml.idp.credential.password=idp-credential-password
saml.idp.keyStore.location=classpath:idp.jks
saml.idp.keyStore.password=idp-jks-password
saml.idp.keyStore.key.password=idp-jks-key-password
saml.idp.keyStore.alias=idp-jks-alias

4. 配置SAML

在WebSecurityConfig.java文件中添加以下代码：

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private SAMLUserDetailsService samlUserDetailsService;

    @Autowired
    private SAMLAuthenticationProvider samlAuthenticationProvider;

    @Autowired
    private SAMLConfigurer samlConfigurer;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/saml/**").permitAll()
                .anyRequest().authenticated()
                .and()
            .apply(samlConfigurer);
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .authenticationProvider(samlAuthenticationProvider);
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web
            .ignoring()
            .antMatchers("/resources/**");
    }

    @Bean
    public SAMLConfigurer saml() {
        return new SAMLConfigurer();
    }

    @Bean
    public SAMLAuthenticationProvider samlAuthenticationProvider() {
        SAMLAuthenticationProvider samlAuthenticationProvider = new SAMLAuthenticationProvider();
        samlAuthenticationProvider.setUserDetails(samlUserDetailsService);
        samlAuthenticationProvider.setForcePrincipalAsString(false);
        return samlAuthenticationProvider;
    }

    @Bean
    public SAMLUserDetailsService samlUserDetailsService() {
        return new SAMLUserDetailsServiceImpl();
    }

}

5. 配置SAMLConfigurer

在SAMLConfigurer.java文件中添加以下代码：

public class SAMLConfigurer extends SamlConfigurerAdapter {

    @Autowired
    private Environment env;

    @Override
    public void configure(SamlServiceProviderConfigurer saml) throws Exception {
        saml
            .metadataGenerator()
                .entityId(env.getProperty("saml.sp.entityId"))
                .entityBaseURL(env.getProperty("saml.sp.assertionConsumerServiceURL"))
                .requestSigned(false)
                .metadataSpLocation(env.getProperty("saml.sp.metadataURL"))
                .signMetadata(false)
                .and()
            .sso()
                .defaultSuccessURL("/home")
                .idpSelectionPageURL("/idpselection")
                .and()
            .credential()
                .privateKeyLocation("classpath:" + env.getProperty("saml.sp.keyStore.location"))
                .privateKeyPassword(env.getProperty("saml.sp.keyStore.key.password"))
                .publicKeyLocation("classpath:" + env.getProperty("saml.sp.keyStore.location"))
                .and()
            .logout()
                .defaultTargetURL("/")
                .and()
            .metadataManager()
                .metadataLocations("classpath:" + env.getProperty("saml.idp.metadataURL"))
                .refreshCheckInterval(0)
                .and()
            .extendedMetadata()
                .idpDiscoveryEnabled(true)
                .idpDiscoveryURL("/idpdiscovery")
                .and()
            .keyManager()
                .privateKeyPassword(env.getProperty("saml.sp.keyStore.key.password"))
                .defaultCredentials(
                    new KeyStoreCredentialResolver(
                        new ClasspathResource(env.getProperty("saml.sp.keyStore.location")),
                        env.getProperty("saml.sp.keyStore.password").toCharArray(),
                        env.getProperty("saml.sp.keyStore.alias"),
                        env.getProperty("saml.sp.keyStore.key.password").toCharArray()
                    ).getCredentials()
                );
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
            .apply(saml())
                .userDetailsService(samlUserDetailsService())
                .sso()
                    .defaultSuccessURL("/home")
                    .and()
                .authenticationProvider(samlAuthenticationProvider())
                .and()
            .logout()
                .logoutSuccessUrl("/");
    }

    @Bean
    public SAMLUserDetailsService samlUserDetailsService() {
        return new SAMLUserDetailsServiceImpl();
    }

    @Bean
    public SAMLAuthenticationProvider samlAuthenticationProvider() {
        SAMLAuthenticationProvider samlAuthenticationProvider = new SAMLAuthenticationProvider();
        samlAuthenticationProvider.setUserDetails(samlUserDetailsService());
        samlAuthenticationProvider.setForcePrincipalAsString(false);
        return samlAuthenticationProvider;
    }

}

6. 编写Controller

编写HomeController.java文件：

@Controller
public class HomeController {

    @GetMapping("/")
    public String index() {
        return "index";
    }

    @GetMapping("/home")
    public String home() {
        return "home";
    }

}

编写SAMLController.java文件：

@Controller
@RequestMapping("/saml")
public class SAMLController {

    @GetMapping("/SSO")
    public String sso() {
        return "redirect:/home";
    }

    @GetMapping("/logout")
    public String logout() {
        return "redirect:/";
    }

}

编写IDPSelectionController.java文件：

@Controller
public class IDPSelectionController {

    @GetMapping("/idpselection")
    public String idpSelection() {
        return "idpselection";
    }

}

编写IDPDiscoveryController.java文件：

@Controller
public class IDPDiscoveryController {

    @GetMapping("/idpdiscovery")
    public String idpDiscovery() {
        return "idpdiscovery";
    }

}

7. 编写视图

编写index.html文件：

<!DOCTYPE html>
<html>
<head>
    <title>Spring Boot SAML 2.0 Example</title>
</head>
<body>
    <h1>Hello World!</h1>

    <a href="/saml/SSO">Login with SAML 2.0</a>
</body>
</html>

编写home.html文件：

<!DOCTYPE html>
<html>
<head>
    <title>Spring Boot SAML 2.0 Example</title>
</head>
<body>
    <h1>Welcome!</h1>

    <a href="/saml/logout">Logout</a>
</body>
</html>

编写idpselection.html文件：

<!DOCTYPE html>
<html>
<head>
    <title>Spring Boot SAML 2.0 Example</title>
</head>
<body>
    <h1>Select an Identity Provider:</h1>

    <ul>
        <li><a href="/saml/login?idp=http://idp.example.com/metadata">IDP 1</a></li>
        <li><a href="/saml/login?idp=http://idp.example.com/metadata">IDP 2</a></li>
    </ul>
</body>
</html>

编写idpdiscovery.html文件：

<!DOCTYPE html>
<html>
<head>
    <title>Spring Boot SAML 2.0 Example</title>
</head>
<body>
    <h1>Select an Identity Provider:</h1>

    <ul>
        <li><a href="/saml/login?idp=http://idp.example.com/metadata">IDP 1</a></li>
        <li><a href="/saml/login?idp=http://idp.example.com/metadata">IDP 2</a></li>
    </ul>
</body>
</html>

8. 运行应用程序

运行应用程序，访问http://localhost:8080/，点击“Login with SAML 2.0”按钮，选择一个Identity Provider登录，即可成功登录应用程序。