diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/builders/FilterOrderRegistration.java b/config/src/main/java/org/springframework/security/config/annotation/web/builders/FilterOrderRegistration.java index 3c0c3cd8c0..0103982ebc 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/web/builders/FilterOrderRegistration.java +++ b/config/src/main/java/org/springframework/security/config/annotation/web/builders/FilterOrderRegistration.java @@ -85,7 +85,7 @@ final class FilterOrderRegistration { "org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRedirectFilter", order.next()); this.filterToOrder.put( - "org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationRequestFilter", + "org.springframework.security.saml2.provider.service.web.Saml2WebSsoAuthenticationRequestFilter", order.next()); put(X509AuthenticationFilter.class, order.next()); put(AbstractPreAuthenticatedProcessingFilter.class, order.next()); @@ -93,7 +93,7 @@ final class FilterOrderRegistration { this.filterToOrder.put("org.springframework.security.oauth2.client.web.OAuth2LoginAuthenticationFilter", order.next()); this.filterToOrder.put( - "org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter", + "org.springframework.security.saml2.provider.service.web.authentication.Saml2WebSsoAuthenticationFilter", order.next()); put(UsernamePasswordAuthenticationFilter.class, order.next()); order.next(); // gh-8105 diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurer.java b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurer.java index 10952228d5..e3293cd6b8 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurer.java +++ b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurer.java @@ -37,8 +37,6 @@ import org.springframework.security.saml2.provider.service.authentication.OpenSa import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationRequestFactory; import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration; import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository; -import org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter; -import org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationRequestFilter; import org.springframework.security.saml2.provider.service.web.DefaultRelyingPartyRegistrationResolver; import org.springframework.security.saml2.provider.service.web.DefaultSaml2AuthenticationRequestContextResolver; import org.springframework.security.saml2.provider.service.web.HttpSessionSaml2AuthenticationRequestRepository; @@ -46,7 +44,9 @@ import org.springframework.security.saml2.provider.service.web.RelyingPartyRegis import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationRequestContextResolver; import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationRequestRepository; import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationTokenConverter; +import org.springframework.security.saml2.provider.service.web.Saml2WebSsoAuthenticationRequestFilter; import org.springframework.security.saml2.provider.service.web.authentication.Saml2AuthenticationRequestResolver; +import org.springframework.security.saml2.provider.service.web.authentication.Saml2WebSsoAuthenticationFilter; import org.springframework.security.web.AuthenticationEntryPoint; import org.springframework.security.web.authentication.AuthenticationConverter; import org.springframework.security.web.authentication.DelegatingAuthenticationEntryPoint; diff --git a/config/src/main/java/org/springframework/security/config/http/Saml2LoginBeanDefinitionParser.java b/config/src/main/java/org/springframework/security/config/http/Saml2LoginBeanDefinitionParser.java index 147166c471..b118dcdcce 100644 --- a/config/src/main/java/org/springframework/security/config/http/Saml2LoginBeanDefinitionParser.java +++ b/config/src/main/java/org/springframework/security/config/http/Saml2LoginBeanDefinitionParser.java @@ -39,8 +39,8 @@ import org.springframework.core.ResolvableType; import org.springframework.security.config.Elements; import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration; import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository; -import org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter; -import org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationRequestFilter; +import org.springframework.security.saml2.provider.service.web.Saml2WebSsoAuthenticationRequestFilter; +import org.springframework.security.saml2.provider.service.web.authentication.Saml2WebSsoAuthenticationFilter; import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint; import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter; import org.springframework.security.web.util.matcher.AntPathRequestMatcher; diff --git a/config/src/test/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurerTests.java b/config/src/test/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurerTests.java index f160ec2d05..144419e28e 100644 --- a/config/src/test/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurerTests.java +++ b/config/src/test/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurerTests.java @@ -87,7 +87,6 @@ import org.springframework.security.saml2.provider.service.registration.InMemory import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration; import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository; import org.springframework.security.saml2.provider.service.registration.TestRelyingPartyRegistrations; -import org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter; import org.springframework.security.saml2.provider.service.web.DefaultRelyingPartyRegistrationResolver; import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationResolver; import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationRequestContextResolver; @@ -95,6 +94,7 @@ import org.springframework.security.saml2.provider.service.web.Saml2Authenticati import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationTokenConverter; import org.springframework.security.saml2.provider.service.web.authentication.OpenSaml4AuthenticationRequestResolver; import org.springframework.security.saml2.provider.service.web.authentication.Saml2AuthenticationRequestResolver; +import org.springframework.security.saml2.provider.service.web.authentication.Saml2WebSsoAuthenticationFilter; import org.springframework.security.web.FilterChainProxy; import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.authentication.AuthenticationConverter; diff --git a/config/src/test/kotlin/org/springframework/security/config/web/servlet/Saml2DslTests.kt b/config/src/test/kotlin/org/springframework/security/config/web/servlet/Saml2DslTests.kt index a9dc47a2da..028635fd63 100644 --- a/config/src/test/kotlin/org/springframework/security/config/web/servlet/Saml2DslTests.kt +++ b/config/src/test/kotlin/org/springframework/security/config/web/servlet/Saml2DslTests.kt @@ -41,7 +41,7 @@ import org.springframework.security.saml2.provider.service.registration.InMemory import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository import org.springframework.security.saml2.provider.service.registration.TestRelyingPartyRegistrations -import org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter +import org.springframework.security.saml2.provider.service.web.authentication.Saml2WebSsoAuthenticationFilter import org.springframework.test.web.servlet.MockMvc import org.springframework.test.web.servlet.get import org.springframework.test.web.servlet.request.MockMvcRequestBuilders diff --git a/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/Saml2AuthenticationToken.java b/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/Saml2AuthenticationToken.java index 705c9d2818..bdf66a4464 100644 --- a/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/Saml2AuthenticationToken.java +++ b/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/Saml2AuthenticationToken.java @@ -22,6 +22,7 @@ import java.util.List; import org.springframework.security.authentication.AbstractAuthenticationToken; import org.springframework.security.saml2.credentials.Saml2X509Credential; import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration; +import org.springframework.security.saml2.provider.service.web.authentication.Saml2WebSsoAuthenticationFilter; import org.springframework.util.Assert; /** @@ -44,9 +45,8 @@ public class Saml2AuthenticationToken extends AbstractAuthenticationToken { * Creates a {@link Saml2AuthenticationToken} with the provided parameters. * * Note that the given {@link RelyingPartyRegistration} should have all its templates - * resolved at this point. See - * {@link org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter} - * for an example of performing that resolution. + * resolved at this point. See {@link Saml2WebSsoAuthenticationFilter} for an example + * of performing that resolution. * @param relyingPartyRegistration the resolved {@link RelyingPartyRegistration} to * use * @param saml2Response the SAML 2.0 response to authenticate @@ -68,9 +68,8 @@ public class Saml2AuthenticationToken extends AbstractAuthenticationToken { * Creates a {@link Saml2AuthenticationToken} with the provided parameters * * Note that the given {@link RelyingPartyRegistration} should have all its templates - * resolved at this point. See - * {@link org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter} - * for an example of performing that resolution. + * resolved at this point. See {@link Saml2WebSsoAuthenticationFilter} for an example + * of performing that resolution. * @param relyingPartyRegistration the resolved {@link RelyingPartyRegistration} to * use * @param saml2Response the SAML 2.0 response to authenticate diff --git a/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationFilter.java b/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationFilter.java index afa6d371ba..e8b80c4559 100644 --- a/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationFilter.java +++ b/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationFilter.java @@ -16,130 +16,30 @@ package org.springframework.security.saml2.provider.service.servlet.filter; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; - -import org.springframework.security.authentication.AbstractAuthenticationToken; -import org.springframework.security.core.Authentication; -import org.springframework.security.core.AuthenticationException; -import org.springframework.security.saml2.core.Saml2Error; -import org.springframework.security.saml2.core.Saml2ErrorCodes; -import org.springframework.security.saml2.provider.service.authentication.AbstractSaml2AuthenticationRequest; -import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationException; import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository; -import org.springframework.security.saml2.provider.service.web.DefaultRelyingPartyRegistrationResolver; -import org.springframework.security.saml2.provider.service.web.HttpSessionSaml2AuthenticationRequestRepository; -import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationResolver; -import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationRequestRepository; -import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationTokenConverter; -import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter; import org.springframework.security.web.authentication.AuthenticationConverter; -import org.springframework.security.web.authentication.session.ChangeSessionIdAuthenticationStrategy; -import org.springframework.util.Assert; /** * @since 5.2 + * @deprecated Use + * {@link org.springframework.security.saml2.provider.service.web.authentication.Saml2WebSsoAuthenticationFilter} + * instead */ -public class Saml2WebSsoAuthenticationFilter extends AbstractAuthenticationProcessingFilter { +@Deprecated +public class Saml2WebSsoAuthenticationFilter + extends org.springframework.security.saml2.provider.service.web.authentication.Saml2WebSsoAuthenticationFilter { - public static final String DEFAULT_FILTER_PROCESSES_URI = "/login/saml2/sso/{registrationId}"; - - private final AuthenticationConverter authenticationConverter; - - private Saml2AuthenticationRequestRepository authenticationRequestRepository = new HttpSessionSaml2AuthenticationRequestRepository(); - - /** - * Creates a {@code Saml2WebSsoAuthenticationFilter} authentication filter that is - * configured to use the {@link #DEFAULT_FILTER_PROCESSES_URI} processing URL - * @param relyingPartyRegistrationRepository - repository of configured SAML 2 - * entities. Required. - */ public Saml2WebSsoAuthenticationFilter(RelyingPartyRegistrationRepository relyingPartyRegistrationRepository) { - this(relyingPartyRegistrationRepository, DEFAULT_FILTER_PROCESSES_URI); + super(relyingPartyRegistrationRepository); } - /** - * Creates a {@code Saml2WebSsoAuthenticationFilter} authentication filter - * @param relyingPartyRegistrationRepository - repository of configured SAML 2 - * entities. Required. - * @param filterProcessesUrl the processing URL, must contain a {registrationId} - * variable. Required. - */ public Saml2WebSsoAuthenticationFilter(RelyingPartyRegistrationRepository relyingPartyRegistrationRepository, String filterProcessesUrl) { - this(new Saml2AuthenticationTokenConverter( - (RelyingPartyRegistrationResolver) new DefaultRelyingPartyRegistrationResolver( - relyingPartyRegistrationRepository)), - filterProcessesUrl); - Assert.isTrue(filterProcessesUrl.contains("{registrationId}"), - "filterProcessesUrl must contain a {registrationId} match variable"); + super(relyingPartyRegistrationRepository, filterProcessesUrl); } - /** - * Creates a {@link Saml2WebSsoAuthenticationFilter} given the provided parameters - * @param authenticationConverter the strategy for converting an - * {@link HttpServletRequest} into an {@link Authentication} - * @param filterProcessesUrl the processing URL - * @since 5.4 - */ public Saml2WebSsoAuthenticationFilter(AuthenticationConverter authenticationConverter, String filterProcessesUrl) { - super(filterProcessesUrl); - Assert.notNull(authenticationConverter, "authenticationConverter cannot be null"); - Assert.hasText(filterProcessesUrl, "filterProcessesUrl must contain a URL pattern"); - this.authenticationConverter = authenticationConverter; - setAllowSessionCreation(true); - setSessionAuthenticationStrategy(new ChangeSessionIdAuthenticationStrategy()); - } - - @Override - protected boolean requiresAuthentication(HttpServletRequest request, HttpServletResponse response) { - return super.requiresAuthentication(request, response); - } - - @Override - public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) - throws AuthenticationException { - Authentication authentication = this.authenticationConverter.convert(request); - if (authentication == null) { - Saml2Error saml2Error = new Saml2Error(Saml2ErrorCodes.RELYING_PARTY_REGISTRATION_NOT_FOUND, - "No relying party registration found"); - throw new Saml2AuthenticationException(saml2Error); - } - setDetails(request, authentication); - this.authenticationRequestRepository.removeAuthenticationRequest(request, response); - return getAuthenticationManager().authenticate(authentication); - } - - /** - * Use the given {@link Saml2AuthenticationRequestRepository} to remove the saved - * authentication request. If the {@link #authenticationConverter} is of the type - * {@link Saml2AuthenticationTokenConverter}, the - * {@link Saml2AuthenticationRequestRepository} will also be set into the - * {@link #authenticationConverter}. - * @param authenticationRequestRepository the - * {@link Saml2AuthenticationRequestRepository} to use - * @since 5.6 - */ - public void setAuthenticationRequestRepository( - Saml2AuthenticationRequestRepository authenticationRequestRepository) { - Assert.notNull(authenticationRequestRepository, "authenticationRequestRepository cannot be null"); - this.authenticationRequestRepository = authenticationRequestRepository; - setAuthenticationRequestRepositoryIntoAuthenticationConverter(authenticationRequestRepository); - } - - private void setAuthenticationRequestRepositoryIntoAuthenticationConverter( - Saml2AuthenticationRequestRepository authenticationRequestRepository) { - if (this.authenticationConverter instanceof Saml2AuthenticationTokenConverter) { - Saml2AuthenticationTokenConverter authenticationTokenConverter = (Saml2AuthenticationTokenConverter) this.authenticationConverter; - authenticationTokenConverter.setAuthenticationRequestRepository(authenticationRequestRepository); - } - } - - private void setDetails(HttpServletRequest request, Authentication authentication) { - if (AbstractAuthenticationToken.class.isAssignableFrom(authentication.getClass())) { - Object details = this.authenticationDetailsSource.buildDetails(request); - ((AbstractAuthenticationToken) authentication).setDetails(details); - } + super(authenticationConverter, filterProcessesUrl); } } diff --git a/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationRequestFilter.java b/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationRequestFilter.java index 4aced5f64a..6b3a67dede 100644 --- a/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationRequestFilter.java +++ b/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationRequestFilter.java @@ -16,43 +16,11 @@ package org.springframework.security.saml2.provider.service.servlet.filter; -import java.io.IOException; -import java.nio.charset.StandardCharsets; - -import javax.servlet.FilterChain; -import javax.servlet.ServletException; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; - -import org.opensaml.core.Version; - -import org.springframework.http.MediaType; -import org.springframework.security.saml2.core.Saml2ParameterNames; -import org.springframework.security.saml2.provider.service.authentication.AbstractSaml2AuthenticationRequest; -import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationRequestContext; import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationRequestFactory; -import org.springframework.security.saml2.provider.service.authentication.Saml2PostAuthenticationRequest; -import org.springframework.security.saml2.provider.service.authentication.Saml2RedirectAuthenticationRequest; import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration; import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository; -import org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding; -import org.springframework.security.saml2.provider.service.web.DefaultRelyingPartyRegistrationResolver; -import org.springframework.security.saml2.provider.service.web.DefaultSaml2AuthenticationRequestContextResolver; -import org.springframework.security.saml2.provider.service.web.HttpSessionSaml2AuthenticationRequestRepository; -import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationResolver; import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationRequestContextResolver; -import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationRequestRepository; import org.springframework.security.saml2.provider.service.web.authentication.Saml2AuthenticationRequestResolver; -import org.springframework.security.web.util.matcher.AntPathRequestMatcher; -import org.springframework.security.web.util.matcher.RequestMatcher; -import org.springframework.security.web.util.matcher.RequestMatcher.MatchResult; -import org.springframework.util.Assert; -import org.springframework.util.ClassUtils; -import org.springframework.util.StringUtils; -import org.springframework.web.filter.OncePerRequestFilter; -import org.springframework.web.util.HtmlUtils; -import org.springframework.web.util.UriComponentsBuilder; -import org.springframework.web.util.UriUtils; /** * This {@code Filter} formulates a @@ -76,239 +44,27 @@ import org.springframework.web.util.UriUtils; * @author Filip Hanik * @author Josh Cummings * @since 5.2 + * @deprecated Use + * {@link org.springframework.security.saml2.provider.service.web.Saml2WebSsoAuthenticationRequestFilter} + * instead */ -public class Saml2WebSsoAuthenticationRequestFilter extends OncePerRequestFilter { +@Deprecated +public class Saml2WebSsoAuthenticationRequestFilter + extends org.springframework.security.saml2.provider.service.web.Saml2WebSsoAuthenticationRequestFilter { - private final Saml2AuthenticationRequestResolver authenticationRequestResolver; - - private Saml2AuthenticationRequestRepository authenticationRequestRepository = new HttpSessionSaml2AuthenticationRequestRepository(); - - /** - * Construct a {@link Saml2WebSsoAuthenticationRequestFilter} with the provided - * parameters - * @param relyingPartyRegistrationRepository a repository for relying party - * configurations - * @deprecated use the constructor that takes a - * {@link Saml2AuthenticationRequestFactory} - */ - @Deprecated public Saml2WebSsoAuthenticationRequestFilter( RelyingPartyRegistrationRepository relyingPartyRegistrationRepository) { - this(new DefaultSaml2AuthenticationRequestContextResolver( - (RelyingPartyRegistrationResolver) new DefaultRelyingPartyRegistrationResolver( - relyingPartyRegistrationRepository)), - requestFactory()); + super(relyingPartyRegistrationRepository); } - private static Saml2AuthenticationRequestFactory requestFactory() { - String opensamlClassName = "org.springframework.security.saml2.provider.service.authentication.OpenSamlAuthenticationRequestFactory"; - if (Version.getVersion().startsWith("4")) { - opensamlClassName = "org.springframework.security.saml2.provider.service.authentication.OpenSaml4AuthenticationRequestFactory"; - } - try { - return (Saml2AuthenticationRequestFactory) ClassUtils.forName(opensamlClassName, null) - .getDeclaredConstructor().newInstance(); - } - catch (Exception ex) { - throw new IllegalStateException(ex); - } - } - - /** - * Construct a {@link Saml2WebSsoAuthenticationRequestFilter} with the provided - * parameters - * @param authenticationRequestContextResolver a strategy for formulating a - * {@link Saml2AuthenticationRequestContext} - * @param authenticationRequestFactory strategy for formulating a - * <saml2:AuthnRequest> - * @since 5.4 - */ public Saml2WebSsoAuthenticationRequestFilter( Saml2AuthenticationRequestContextResolver authenticationRequestContextResolver, Saml2AuthenticationRequestFactory authenticationRequestFactory) { - this(new FactorySaml2AuthenticationRequestResolver(authenticationRequestContextResolver, - authenticationRequestFactory)); + super(authenticationRequestContextResolver, authenticationRequestFactory); } - /** - * Construct a {@link Saml2WebSsoAuthenticationRequestFilter} with the strategy for - * resolving the {@code AuthnRequest} - * @param authenticationRequestResolver the strategy for resolving the - * {@code AuthnRequest} - * @since 5.7 - */ public Saml2WebSsoAuthenticationRequestFilter(Saml2AuthenticationRequestResolver authenticationRequestResolver) { - Assert.notNull(authenticationRequestResolver, "authenticationRequestResolver cannot be null"); - this.authenticationRequestResolver = authenticationRequestResolver; - } - - /** - * Use the given {@link Saml2AuthenticationRequestFactory} for formulating the SAML - * 2.0 AuthnRequest - * @param authenticationRequestFactory the {@link Saml2AuthenticationRequestFactory} - * to use - * @deprecated use the constructor instead - */ - @Deprecated - public void setAuthenticationRequestFactory(Saml2AuthenticationRequestFactory authenticationRequestFactory) { - Assert.notNull(authenticationRequestFactory, "authenticationRequestFactory cannot be null"); - Assert.isInstanceOf(FactorySaml2AuthenticationRequestResolver.class, this.authenticationRequestResolver, - "You cannot supply both a Saml2AuthenticationRequestResolver and a Saml2AuthenticationRequestFactory"); - ((FactorySaml2AuthenticationRequestResolver) this.authenticationRequestResolver).authenticationRequestFactory = authenticationRequestFactory; - } - - /** - * Use the given {@link RequestMatcher} that activates this filter for a given request - * @param redirectMatcher the {@link RequestMatcher} to use - * @deprecated Configure the request matcher in an implementation of - * {@link Saml2AuthenticationRequestResolver} instead - */ - @Deprecated - public void setRedirectMatcher(RequestMatcher redirectMatcher) { - Assert.notNull(redirectMatcher, "redirectMatcher cannot be null"); - Assert.isInstanceOf(FactorySaml2AuthenticationRequestResolver.class, this.authenticationRequestResolver, - "You cannot supply a Saml2AuthenticationRequestResolver and a redirect matcher"); - ((FactorySaml2AuthenticationRequestResolver) this.authenticationRequestResolver).redirectMatcher = redirectMatcher; - } - - /** - * Use the given {@link Saml2AuthenticationRequestRepository} to save the - * authentication request - * @param authenticationRequestRepository the - * {@link Saml2AuthenticationRequestRepository} to use - * @since 5.6 - */ - public void setAuthenticationRequestRepository( - Saml2AuthenticationRequestRepository authenticationRequestRepository) { - Assert.notNull(authenticationRequestRepository, "authenticationRequestRepository cannot be null"); - this.authenticationRequestRepository = authenticationRequestRepository; - } - - @Override - protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) - throws ServletException, IOException { - AbstractSaml2AuthenticationRequest authenticationRequest = this.authenticationRequestResolver.resolve(request); - if (authenticationRequest == null) { - filterChain.doFilter(request, response); - return; - } - if (authenticationRequest instanceof Saml2RedirectAuthenticationRequest) { - sendRedirect(request, response, (Saml2RedirectAuthenticationRequest) authenticationRequest); - } - else { - sendPost(request, response, (Saml2PostAuthenticationRequest) authenticationRequest); - } - } - - private void sendRedirect(HttpServletRequest request, HttpServletResponse response, - Saml2RedirectAuthenticationRequest authenticationRequest) throws IOException { - this.authenticationRequestRepository.saveAuthenticationRequest(authenticationRequest, request, response); - UriComponentsBuilder uriBuilder = UriComponentsBuilder - .fromUriString(authenticationRequest.getAuthenticationRequestUri()); - addParameter(Saml2ParameterNames.SAML_REQUEST, authenticationRequest.getSamlRequest(), uriBuilder); - addParameter(Saml2ParameterNames.RELAY_STATE, authenticationRequest.getRelayState(), uriBuilder); - addParameter(Saml2ParameterNames.SIG_ALG, authenticationRequest.getSigAlg(), uriBuilder); - addParameter(Saml2ParameterNames.SIGNATURE, authenticationRequest.getSignature(), uriBuilder); - String redirectUrl = uriBuilder.build(true).toUriString(); - response.sendRedirect(redirectUrl); - } - - private void addParameter(String name, String value, UriComponentsBuilder builder) { - Assert.hasText(name, "name cannot be empty or null"); - if (StringUtils.hasText(value)) { - builder.queryParam(UriUtils.encode(name, StandardCharsets.ISO_8859_1), - UriUtils.encode(value, StandardCharsets.ISO_8859_1)); - } - } - - private void sendPost(HttpServletRequest request, HttpServletResponse response, - Saml2PostAuthenticationRequest authenticationRequest) throws IOException { - this.authenticationRequestRepository.saveAuthenticationRequest(authenticationRequest, request, response); - String html = createSamlPostRequestFormData(authenticationRequest); - response.setContentType(MediaType.TEXT_HTML_VALUE); - response.getWriter().write(html); - } - - private String createSamlPostRequestFormData(Saml2PostAuthenticationRequest authenticationRequest) { - String authenticationRequestUri = authenticationRequest.getAuthenticationRequestUri(); - String relayState = authenticationRequest.getRelayState(); - String samlRequest = authenticationRequest.getSamlRequest(); - StringBuilder html = new StringBuilder(); - html.append("\n"); - html.append("\n").append(" \n"); - html.append("