CODEWITHSUNDEEP
springspring-securitysamlsaml-2.0spring-saml
Eager
Eager

Reputation: 1691

Spring SAML: alternative ways to generate SP metadata besides using /saml/metadata endpoint

Background: my web-app is running in PROD, and real users are using it. The initial authentication was implemented using Spring Basic Security.

Recently, client decided to use SSO for authentication, so my app should act as SP with client IdP. I used Spring SAML to configure my app as SP.

Integration with client IdP on QA environment involved next steps:

  1. Get and store IdP metadata file received from customer.
  2. Deploy code with SP configuration on the environment.
  3. Generate SP metadata file using /saml/metadata endpoint and share it with customer.
  4. Get a green light from customer IdP side that SP metadata file in a right place.
  5. Verify that SSO is working successfully.

Now, It's time to deploy SP SSO configuration on PROD environment and integrate it with client PROD IdP.

I don't like to use the approach above for PROD, as real users will not be able to login into the app until app SP metadata file will be generated, and put in a right place at customer IdP.

Can anyone tell me how can I generate SP metadata file for my app in advance, before deploying SSO configuration on PROD?

Upvotes: 1

Views: 7961

Answers (2)

winstonhong
winstonhong

Reputation: 1349

(1) Quote "Recently, client decided to use SSO for authentication, so my app should act as SP with client IdP. I used Spring SAML to configure my app as SP."

Response:

I suppose that you use Spring SAML provided by the official GitHub repository of Spring Security SAML to "configure your app as SP".

(2) Quote "Integration with client IdP on QA environment involved next steps:.."

Response:

The five (5) steps (provided by your post) regarding integration of your web app as SP with client IdP are the practical SAML standard for "deploying SP SSO configuration on PROD environment and integrate it with client PROD IdP."

I have shared hands-on experience on integration of web app as SAML SP with SAML IdP by providing my answer to another recent Stackoverflow question "I have provided an instruction to address another Stackoverflow How can I generate metadata file of my Java Spring Application to establish a connection with Identity Provider like Ping Federate?"

(3) Quote "I don't like to use the approach above for PROD, as real users will not be able to login into the app until app SP metadata file will be generated, and put in a right place at customer IdP."

Response:

If you "don't like to use the approach above for PROD", you can modify the source code of "spring-security-saml/samples/boot/simple-service-provider/" (provided by the official GitHub repository of Spring Security SAML) to configure your web app as SAML SP.

(4) Question "Can anyone tell me how can I generate SP metadata file for my app in advance, before deploying SSO configuration on PROD?"

Answer:

(I) The README on "How to run a simple sample of an Identity Provider (IDP) and Service Provider (SP)" (provided by the official GitHub repository of Spring Security SAML) will guide you "how can I generate SP metadata file for my app in advance, before deploying SSO configuration on PROD".

(II) I highlight the related information on "how to generate SAML SP metadata file of Spring Basic Security for my web app in advance, before deploying SSO configuration on PROD" (Quote your question).

Step 2 - Start the Service Provider

Service Provider runs on http://localhost:8080/sample-sp

$git clone https://github.com/spring-projects/spring-security-saml

$cd spring-security-saml

$./gradlew :spring-security-saml-samples/boot/simple-service-provider:bootRun &

(II.a) Launch a web browser to access the URL http://localhost:8080/sample-sp to ensure that Spring Security SAML Service Provider runs well.

(II.b) Launch a web browser to access the SP metadata endpoint
http://localhost:8080/sample-sp/saml/sp/metadata
to download or "generate SP metadata file for my app in advance, before deploying SSO configuration on PROD" (Quote your question).

(5) Question "Spring SAML: alternative ways to generate SP metadata besides using /saml/metadata endpoint"

Answer:

you can modify the source code of "spring-security-saml/samples/boot/simple-service-provider/src/main/java/sample/config/SecurityConfiguration.java" (provided by the official GitHub repository of Spring Security SAML) to "generate SP metadata besides using /saml/sp/metadata endpoint".

For example, if you want to generate SP metadata from a specific endpoint such as /example/metadata, then you just need to replace
"super("/saml/sp/", beanConfig);"
(in the source code shown below) with
"super("/example/", beanConfig);"

        public SamlSecurity(BeanConfig beanConfig, @Qualifier("appConfig") AppConfig appConfig) {
            super("/saml/sp/", beanConfig);
            this.appConfig = appConfig;
}

Upvotes: 4

Bernhard Thalmayr
Bernhard Thalmayr

Reputation: 2744

As long as you know the URIs of the endpoints and the signature certificate you can generate them manually and specify it in the configuration.

Upvotes: 0

Related Questions