we are facing an issue where in an IDP initiated SSO, we have a requirement to provide a common single sign on url to all the IDPs but with spring security latest version, the url should be {baseUrl}/login/saml2/sso/{registrationId}. We want something like
{baseUrl}/sso/saml2 - generic for all.
My yml file looks like this:
spring:
security:
saml2:
relyingparty:
registration:
okta1:
signing:
credentials:
assertingparty:
metadata-uri: "IDP metadata url"
entity-id: "SP-entity-id"
okta2:
signing:
credentials:
assertingparty:
metadata-uri: "IDP metadata url"
entity-id: "SP-entity-id"
Configuration file looks like this: @Configuration @EnableWebSecurity public class SecurityConfig implements WebMvcConfigurer {
final RelyingPartyRegistrationRepository relyingPartyRegistrationRepository;
public SecurityConfig(RelyingPartyRegistrationRepository relyingPartyRegistrationRepository) {
this.relyingPartyRegistrationRepository = relyingPartyRegistrationRepository;
}
/*public void addInterceptors(InterceptorRegistry registry) {
registry.addInterceptor(new CustomInterceptor());
}*/
@Bean
public SecurityFilterChain configure(HttpSecurity http) throws Exception {
DefaultRelyingPartyRegistrationResolver relyingPartyRegistrationResolver =
new DefaultRelyingPartyRegistrationResolver(this.relyingPartyRegistrationRepository);
// RelyingPartyRegistration
Saml2MetadataFilter filter = new Saml2MetadataFilter(
(Converter<HttpServletRequest, RelyingPartyRegistration>) relyingPartyRegistrationResolver,
new OpenSamlMetadataResolver());
filter.setRequestMatcher(new AntPathRequestMatcher("SP Entity ID"));
OpenSaml4AuthenticationProvider authenticationProvider = new OpenSaml4AuthenticationProvider();
// authenticationProvider.setResponseAuthenticationConverter(groupsConverter());
//http.httpBasic().disable();
ObjectPostProcessor processor = new ObjectPostProcessor<Saml2WebSsoAuthenticationRequestFilter>() {
@Override
public <O extends Saml2WebSsoAuthenticationRequestFilter> O postProcess(O filter) {
filter.setRedirectMatcher(new AntPathRequestMatcher("/customURL"));
return filter;
}
};
http
// .exceptionHandling((exceptions) -> exceptions.authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/brokersso")))
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()).csrf().disable()
//.ignoringAntMatchers("/login/saml2/sso/**")
//.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()).and()
.saml2Login(saml2 -> saml2
.authenticationManager(new ProviderManager(authenticationProvider))
.loginProcessingUrl("/brokersso"))
.addFilterBefore(filter, Saml2WebSsoAuthenticationFilter.class);
return http.build();
}
I tried changing the url by creating a rest end point on a controller and try to recieve my request there, intercept it, and based upon the entityID of the IDP, reroute to the correct URL but whenever i am initiating IDP SSO, spring security is not moving forward and always loading the login page.
once the assertion comes from IDP, then we will have to figure out which idp this belongs to and then reroute it to the correct url with registration id.