Redirecting to IdP Automatically using Spring SAML

Question

Just started working with SAML yesterday and have run into all sorts of issues, most of which I worked out. However, one that I still have not is how to turn off discovery so Spring auto redirects to the IdP (I only have one and have also set it to default) when any protected resource is accessed. I see in Springs docs that you can easily turn off discovery, however the docs seem to be lacking in examples and/or details, so I am not totally sure how to do it.

Thus far, I have tried setting the idpSelectionPath to empty, as well as using includeDiscoveryExtension and idpDiscoveryEnabled set to false. Using the direct URL (context/saml/login?idp=IDP) does work, but is not an option as my requirement is for any protected URL to auto redirect to the IdP if the user is not signed in.

The below is a working version of my securityContext.xml file, as some of the changes I made (such as removing all the discovery settings) caused a browser error of an endless loop to occur. Any and all help is appreciated. Thanks!

<?xml version="1.0" encoding="UTF-8" ?>

<beans xmlns="http://www.springframework.org/schema/beans"

   xmlns:security="http://www.springframework.org/schema/security"

   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

   xmlns:context="http://www.springframework.org/schema/context"

   xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd

          http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd">

<!-- Enable auto-wiring -->

<context:annotation-config/>

<context:component-scan base-package="org.springframework.security.saml"/>

<!-- Unsecured pages -->

<security:http security="none" pattern="/saml/web/**"/>

<security:http security="none" pattern="/logout.jsp"/>

<security:http security="none" pattern="/favicon.ico"/>

<!-- Secured pages -->

<security:http entry-point-ref="samlEntryPoint">

    <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY"/>

    <security:custom-filter before="FIRST" ref="metadataGeneratorFilter"/>

    <security:custom-filter after="BASIC_AUTH_FILTER" ref="samlFilter"/>

</security:http>

<bean id="samlFilter" class="org.springframework.security.web.FilterChainProxy">

    <security:filter-chain-map request-matcher="ant">

        <security:filter-chain pattern="/saml/login/**" filters="samlEntryPoint"/>

        <security:filter-chain pattern="/saml/logout/**" filters="samlLogoutFilter"/>

        <security:filter-chain pattern="/saml/metadata/**" filters="metadataDisplayFilter"/>

        <security:filter-chain pattern="/saml/SSO/**" filters="samlWebSSOProcessingFilter"/>

        <security:filter-chain pattern="/saml/SSOHoK/**" filters="samlWebSSOHoKProcessingFilter"/>

        <security:filter-chain pattern="/saml/SingleLogout/**" filters="samlLogoutProcessingFilter"/>

        <security:filter-chain pattern="/saml/discovery/**" filters="samlIDPDiscovery"/>

    </security:filter-chain-map>

</bean>

<!-- Handler deciding where to redirect user after successful login -->

<bean id="successRedirectHandler"

      class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">

    <property name="defaultTargetUrl" value="/"/>

</bean>

<!--

Use the following for interpreting RelayState coming from unsolicited response as redirect URL:

<bean id="successRedirectHandler" class="org.springframework.security.saml.SAMLRelayStateSuccessHandler">

   <property name="defaultTargetUrl" value="/" />

</bean>

-->

<!-- Handler for successful logout -->

<bean id="successLogoutHandler" class="org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler">

    <property name="defaultTargetUrl" value="/logout.jsp"/>

</bean>

<!-- Register authentication manager with SAML provider -->

<security:authentication-manager alias="authenticationManager">

    <security:authentication-provider ref="samlAuthenticationProvider"/>

</security:authentication-manager>

<!-- Logger for SAML messages and events -->

<bean id="samlLogger" class="org.springframework.security.saml.log.SAMLDefaultLogger"/>

<!-- Central storage of cryptographic keys -->

<bean id="keyManager" class="org.springframework.security.saml.key.JKSKeyManager">

    <constructor-arg value="classpath:security/samlKeystore.jks"/>

    <constructor-arg type="java.lang.String" value="nalle123"/>

    <constructor-arg>

        <map>

            <entry key="apollo" value="nalle123"/>

        </map>

    </constructor-arg>

    <constructor-arg type="java.lang.String" value="apollo"/>

</bean>

<!-- Entry point to initialize authentication, default values taken from properties file -->

<bean id="samlEntryPoint" class="org.springframework.security.saml.SAMLEntryPoint">

    <property name="defaultProfileOptions">

        <bean class="org.springframework.security.saml.websso.WebSSOProfileOptions">

            <property name="includeScoping" value="false"/>

        </bean>

    </property>

</bean>

<!-- IDP Discovery Service -->

<bean id="samlIDPDiscovery" class="org.springframework.security.saml.SAMLDiscovery">

    <property name="idpSelectionPath" value="/WEB-INF/security/idpSelection.jsp"/>

</bean>

<!-- Filter automatically generates default SP metadata -->

<!-- The filter is waiting for connections on URL suffixed with filterSuffix and presents SP metadata there -->

<bean id="metadataDisplayFilter" class="org.springframework.security.saml.metadata.MetadataDisplayFilter"/>

<!-- IDP Metadata configuration - paths to metadata of IDPs in circle of trust is here -->

<!-- Do no forget to call iniitalize method on providers -->

<bean id="metadata" class="org.springframework.security.saml.metadata.CachingMetadataManager">

<constructor-arg>

    <list>

        <bean class="org.springframework.security.saml.metadata.ExtendedMetadataDelegate">

<constructor-arg>

    <bean class="org.opensaml.saml2.metadata.provider.FilesystemMetadataProvider">

        <constructor-arg>

            <value type="java.io.File">C:/SAMLIdP-00D1a000000KR5C.xml</value>

        </constructor-arg>

        <property name="parserPool" ref="parserPool"/>

    </bean>

</constructor-arg>

<constructor-arg>

    <bean class="org.springframework.security.saml.metadata.ExtendedMetadata"/>

</constructor-arg>

</bean>

    </list>

</constructor-arg>

<property name="defaultIDP" value="https://mrc-dev-ed.my.salesforce.com"/>

</bean>

<!-- SAML Authentication Provider responsible for validating of received SAML messages -->

<bean id="samlAuthenticationProvider" class="org.springframework.security.saml.SAMLAuthenticationProvider">

    <!-- OPTIONAL property: can be used to store/load user data after login -->

    <!--

    <property name="userDetails" ref="bean" />

    -->

</bean>

<!-- Provider of default SAML Context -->

<bean id="contextProvider" class="org.springframework.security.saml.context.SAMLContextProviderImpl"/>

<!-- Processing filter for WebSSO profile messages -->

<bean id="samlWebSSOProcessingFilter" class="org.springframework.security.saml.SAMLProcessingFilter">

    <property name="authenticationManager" ref="authenticationManager"/>

    <property name="authenticationSuccessHandler" ref="successRedirectHandler"/>

</bean>

<!-- Processing filter for WebSSO Holder-of-Key profile -->

<bean id="samlWebSSOHoKProcessingFilter" class="org.springframework.security.saml.SAMLWebSSOHoKProcessingFilter">

    <property name="authenticationManager" ref="authenticationManager"/>

    <property name="authenticationSuccessHandler" ref="successRedirectHandler"/>

</bean>

<!-- Logout handler terminating local session -->

<bean id="logoutHandler"

      class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler">

    <property name="invalidateHttpSession" value="false"/>

</bean>

<!-- Override default logout processing filter with the one processing SAML messages -->

<bean id="samlLogoutFilter" class="org.springframework.security.saml.SAMLLogoutFilter">

    <constructor-arg ref="successLogoutHandler"/>

    <constructor-arg ref="logoutHandler"/>

    <constructor-arg ref="logoutHandler"/>

</bean>

<!-- Filter processing incoming logout messages -->

<!-- First argument determines URL user will be redirected to after successful global logout -->

<bean id="samlLogoutProcessingFilter" class="org.springframework.security.saml.SAMLLogoutProcessingFilter">

    <constructor-arg ref="successLogoutHandler"/>

    <constructor-arg ref="logoutHandler"/>

</bean>

<!-- Class loading incoming SAML messages from httpRequest stream -->

<bean id="processor" class="org.springframework.security.saml.processor.SAMLProcessorImpl">

    <constructor-arg>

        <list>

            <ref bean="redirectBinding"/>

            <ref bean="postBinding"/>

            <ref bean="artifactBinding"/>

            <ref bean="soapBinding"/>

            <ref bean="paosBinding"/>

        </list>

    </constructor-arg>

</bean>

<!-- SAML 2.0 WebSSO Assertion Consumer -->

<bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl"/>

<!-- SAML 2.0 Holder-of-Key WebSSO Assertion Consumer -->

<bean id="hokWebSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerHoKImpl"/>

<!-- SAML 2.0 Web SSO profile -->

<bean id="webSSOprofile" class="org.springframework.security.saml.websso.WebSSOProfileImpl"/>

<!-- SAML 2.0 Holder-of-Key Web SSO profile -->

<bean id="hokWebSSOProfile" class="org.springframework.security.saml.websso.WebSSOProfileConsumerHoKImpl"/>

<!-- SAML 2.0 ECP profile -->

<bean id="ecpprofile" class="org.springframework.security.saml.websso.WebSSOProfileECPImpl"/>

<!-- SAML 2.0 Logout Profile -->

<bean id="logoutprofile" class="org.springframework.security.saml.websso.SingleLogoutProfileImpl"/>

<!-- Bindings, encoders and decoders used for creating and parsing messages -->

<bean id="postBinding" class="org.springframework.security.saml.processor.HTTPPostBinding">

    <constructor-arg ref="parserPool"/>

    <constructor-arg ref="velocityEngine"/>

</bean>

<bean id="redirectBinding" class="org.springframework.security.saml.processor.HTTPRedirectDeflateBinding">

    <constructor-arg ref="parserPool"/>

</bean>

<bean id="artifactBinding" class="org.springframework.security.saml.processor.HTTPArtifactBinding">

    <constructor-arg ref="parserPool"/>

    <constructor-arg ref="velocityEngine"/>

    <constructor-arg>

        <bean class="org.springframework.security.saml.websso.ArtifactResolutionProfileImpl">

            <constructor-arg>

                <bean class="org.apache.commons.httpclient.HttpClient"/>

            </constructor-arg>

            <property name="processor">

                <bean id="soapProcessor" class="org.springframework.security.saml.processor.SAMLProcessorImpl">

                    <constructor-arg ref="soapBinding"/>

                </bean>

            </property>

        </bean>

    </constructor-arg>

</bean>

<bean id="soapBinding" class="org.springframework.security.saml.processor.HTTPSOAP11Binding">

    <constructor-arg ref="parserPool"/>

</bean>

<bean id="paosBinding" class="org.springframework.security.saml.processor.HTTPPAOS11Binding">

    <constructor-arg ref="parserPool"/>

</bean>

<!-- Initialization of OpenSAML library-->

<bean class="org.springframework.security.saml.SAMLBootstrap"/>

<!-- Initialization of the velocity engine -->

<bean id="velocityEngine" class="org.springframework.security.saml.util.VelocityFactory" factory-method="getEngine"/>

<!-- XML parser pool needed for OpenSAML parsing -->

<bean id="parserPool" class="org.opensaml.xml.parse.StaticBasicParserPool" scope="singleton" init-method="initialize"/>

<bean id="parserPoolHolder" class="org.springframework.security.saml.parser.ParserPoolHolder" scope="singleton"/>

</beans>

Answer 1

Installing the idpDiscoveryEnabled property to false in the MetadataGeneratorFilter ran for me. Something like:

<bean id="metadataGeneratorFilter" class="org.springframework.security.saml.metadata.MetadataGeneratorFilter">

        <constructor-arg>

            <bean class="org.springframework.security.saml.metadata.MetadataGenerator">

                <property name="extendedMetadata">

                    <bean class="org.springframework.security.saml.metadata.ExtendedMetadata">

                        <property name="idpDiscoveryEnabled" value="false"/>

                    </bean>

                </property>

            </bean>

        </constructor-arg>

    </bean>