SpringCloud Gateway对接SAML2的案例

SpringCloud Gateway可以通过Spring Security来实现SAML2认证，下面是一个简单的案例：

1. 添加依赖

在pom.xml中添加以下依赖：

<dependency>
    <groupId>org.springframework.security.extensions</groupId>
    <artifactId>spring-security-saml2-core</artifactId>
    <version>1.0.10.RELEASE</version>
</dependency>

2. 配置SAML2认证

在Spring Security配置中添加以下内容：

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private SAMLUserDetailsService samlUserDetailsService;

    @Autowired
    private SAMLAuthenticationProvider samlAuthenticationProvider;

    @Autowired
    private SAMLConfigurer samlConfigurer;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
            .authorizeRequests()
            .antMatchers("/saml/**").permitAll()
            .anyRequest().authenticated()
            .and()
            .apply(samlConfigurer);
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(samlAuthenticationProvider);
    }

    @Bean
    public SAMLConfigurer samlConfigurer() {
        return new SAMLConfigurer();
    }

    @Bean
    public SAMLUserDetailsService samlUserDetailsService() {
        return new SAMLUserDetailsServiceImpl();
    }

    @Bean
    public SAMLAuthenticationProvider samlAuthenticationProvider() {
        SAMLAuthenticationProvider provider = new SAMLAuthenticationProvider();
        provider.setUserDetails(samlUserDetailsService());
        provider.setForcePrincipalAsString(false);
        return provider;
    }
}

在上面的配置中，我们定义了一个SAMLUserDetailsService，用于获取SAML认证信息中的用户信息，同时也定义了一个SAMLAuthenticationProvider，用于对SAML认证信息进行认证。

3. 配置SAML2元数据

在application.yml中添加以下内容：

spring:
  security:
    saml2:
      metadata-url: http://idp.example.com/metadata
      entity-id: https://gateway.example.com/saml/metadata
      signing-key: |
        -----BEGIN RSA PRIVATE KEY-----
        MIIEowIBAAKCAQEAyeFw4C4LJ8aRmL2QGnSvSfWb9XICdxpIzqD3tY5uVg5iZPfN
        ...
        -----END RSA PRIVATE KEY-----
      encryption-key: |
        -----BEGIN RSA PRIVATE KEY-----
        MIIEowIBAAKCAQEAyeFw4C4LJ8aRmL2QGnSvSfWb9XICdxpIzqD3tY5uVg5iZPfN
        ...
        -----END RSA PRIVATE KEY-----
      verification-key: |
        -----BEGIN CERTIFICATE-----
        MIIDrjCCApagAwIBAgIGAVxQyBANBgkqhkiG9w0BAQsFADCBjTELMAkGA1UEBhMC
        ...
        -----END CERTIFICATE-----

其中，metadata-url是SAML2元数据的URL，entity-id是网关的实体ID，signing-key是网关的签名密钥，encryption-key是网关的加密密钥，verification-key是SAML2提供商的验证证书。

4. 配置路由

在application.yml中添加以下内容：

spring:
  cloud:
    gateway:
      routes:
        - id: saml_route
          uri: http://backend.example.com
          predicates:
            - Path=/backend/**
          filters:
            - SAML2LoginRedirect
            - SAML2Login

在上面的配置中，我们将请求路径为/backend/**的请求路由到后端服务，同时使用SAML2LoginRedirect和SAML2Login过滤器进行SAML2认证。

5. 配置SAML2过滤器

在SAMLConfigurer中添加以下内容：

public class SAMLConfigurer extends SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity> {

    @Autowired
    private SAMLUserDetailsService samlUserDetailsService;

    @Autowired
    private SAMLAuthenticationProvider samlAuthenticationProvider;

    @Value("${spring.security.saml2.metadata-url}")
    private String metadataUrl;

    @Value("${spring.security.saml2.entity-id}")
    private String entityId;

    @Value("${spring.security.saml2.signing-key}")
    private String signingKey;

    @Value("${spring.security.saml2.encryption-key}")
    private String encryptionKey;

    @Value("${spring.security.saml2.verification-key}")
    private String verificationKey;

    @Override
    public void configure(HttpSecurity http) throws Exception {
        SAMLConfigurerBean samlConfigurerBean = new SAMLConfigurerBean();
        samlConfigurerBean.setMetadataURL(metadataUrl);
        samlConfigurerBean.setEntityId(entityId);
        samlConfigurerBean.setTlsKey(signingKey);
        samlConfigurerBean.setTlsKeyPassword("");
        samlConfigurerBean.setTlsCert(encryptionKey);
        samlConfigurerBean.setVerificationCertificate(verificationKey);
        samlConfigurerBean.setSsoLoginURL("http://idp.example.com/login");
        samlConfigurerBean.setSsoLogoutURL("http://idp.example.com/logout");

        SAMLConfigurerFilter samlFilter = new SAMLConfigurerFilter(samlConfigurerBean);
        http.addFilterBefore(samlFilter, BasicAuthenticationFilter.class);
    }

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(samlAuthenticationProvider);
    }

    @Bean
    public SAMLConfigurer samlConfigurer() {
        return new SAMLConfigurer();
    }

    @Bean
    public SAMLUserDetailsService samlUserDetailsService() {
        return new SAMLUserDetailsServiceImpl();
    }

    @Bean
    public SAMLAuthenticationProvider samlAuthenticationProvider() {
        SAMLAuthenticationProvider provider = new SAMLAuthenticationProvider();
        provider.setUserDetails(samlUserDetailsService());
        provider.setForcePrincipalAsString(false);
        return provider;
    }
}

在上面的配置中，我们定义了一个SAMLConfigurerBean，用于配置SAML2提供商的信息，同时也定义了一个SAMLConfigurerFilter，用于对SAML2认证信息进行过滤。

6. 测试

启动应用程序并访问http://gateway.example.com/backend/test，应该会跳转到SAML2提供商的登录页面进行登录，登录成功后应该会被重定向到http://gateway.example.com/backend/test。