对于最新的稳定版本，请使用 Spring Security 6.5.3！spring-doc.cadn.net.cn

Saml 2.0 元数据

Spring Security 可以解析断言方元数据以生成AssertingPartyDetails实例以及从RelyingPartyRegistration实例。spring-doc.cadn.net.cn

解析<saml2:IDPSSODescriptor>元数据

您可以解析断言方的元数据用RelyingPartyRegistrations.spring-doc.cadn.net.cn

使用 OpenSAML 提供商支持时，生成的AssertingPartyDetails将是类型OpenSamlAssertingPartyDetails. 这意味着你可以通过执行以下作来获取底层 OpenSAML XMLObject：spring-doc.cadn.net.cn

OpenSamlAssertingPartyDetails details = (OpenSamlAssertingPartyDetails)
        registration.getAssertingPartyDetails();
EntityDescriptor openSamlEntityDescriptor = details.getEntityDescriptor();
val details: OpenSamlAssertingPartyDetails =
        registration.getAssertingPartyDetails() as OpenSamlAssertingPartyDetails;
val openSamlEntityDescriptor: EntityDescriptor = details.getEntityDescriptor();

生产<saml2:SPSSODescriptor>元数据

您可以通过添加Saml2MetadataFilter到过滤器链，如下所示：spring-doc.cadn.net.cn

DefaultRelyingPartyRegistrationResolver relyingPartyRegistrationResolver =
        new DefaultRelyingPartyRegistrationResolver(this.relyingPartyRegistrationRepository);
Saml2MetadataFilter filter = new Saml2MetadataFilter(
        relyingPartyRegistrationResolver,
        new OpenSamlMetadataResolver());

http
    // ...
    .saml2Login(withDefaults())
    .addFilterBefore(filter, Saml2WebSsoAuthenticationFilter.class);
val relyingPartyRegistrationResolver: Converter<HttpServletRequest, RelyingPartyRegistration> =
    DefaultRelyingPartyRegistrationResolver(this.relyingPartyRegistrationRepository)
val filter = Saml2MetadataFilter(
    relyingPartyRegistrationResolver,
    OpenSamlMetadataResolver()
)

http {
    //...
    saml2Login { }
    addFilterBefore<Saml2WebSsoAuthenticationFilter>(filter)
}

您可以使用此元数据终结点向断言方注册信赖方。这通常就像查找正确的窗体字段来提供元数据终结点一样简单。spring-doc.cadn.net.cn

默认情况下，元数据终结点为/saml2/service-provider-metadata/{registrationId}. 您可以通过调用setRequestMatcher过滤器上的方法：spring-doc.cadn.net.cn

filter.setRequestMatcher(new AntPathRequestMatcher("/saml2/metadata/{registrationId}", "GET"));
filter.setRequestMatcher(AntPathRequestMatcher("/saml2/metadata/{registrationId}", "GET"))

或者，如果已在构造函数中注册了自定义信赖方注册解析程序，则可以指定不带registrationId提示，如下所示：spring-doc.cadn.net.cn

filter.setRequestMatcher(new AntPathRequestMatcher("/saml2/metadata", "GET"));
filter.setRequestMatcher(AntPathRequestMatcher("/saml2/metadata", "GET"))

改变方式RelyingPartyRegistration被查找

应用自定义RelyingPartyRegistrationResolver到元数据终结点，可以直接在筛选器构造函数中提供它，如下所示：spring-doc.cadn.net.cn

RelyingPartyRegistrationResolver myRegistrationResolver = ...;
Saml2MetadataFilter metadata = new Saml2MetadataFilter(myRegistrationResolver, new OpenSamlMetadataResolver());

// ...

http.addFilterBefore(metadata, BasicAuthenticationFilter.class);
Kotlin
val myRegistrationResolver: RelyingPartyRegistrationResolver = ...;
val metadata = new Saml2MetadataFilter(myRegistrationResolver, OpenSamlMetadataResolver());

// ...

http.addFilterBefore(metadata, BasicAuthenticationFilter::class.java);

如果您正在申请RelyingPartyRegistrationResolver删除registrationId，您还必须更改过滤器中的 URI，如下所示：spring-doc.cadn.net.cn

metadata.setRequestMatcher("/saml2/metadata")
Kotlin
metadata.setRequestMatcher("/saml2/metadata")