用于多个IDP的弹簧SAML扩展

我们计划将Spring saml扩展用作SP作为我们的应用程序。但随着我们的应用程序的要求，我们需要有超过1 IDP的沟通可以在任何一个，请提供给我/告诉我去哪里，它使用多个IDP的用于多个IDP的弹簧SAML扩展

我也想知道春天SAML扩展支持什么样的例子有点像OPenAM /平境内流离失所者的联合/ ADFs2.0等等

感谢， --Vikas

来源

2014-09-24 Vikas Shivashankara

你可以找到所有的答案在Spring SAML manual你的问题。

作为产品一部分包含的示例应用程序已包含metadata for two IDPs，以此为例。

上流离失所声明被包括在章节1.2：

所有产品在身份提供商模式支持SAML 2.0（例如ADFS 2.0，示播列，OpenAM/OpenSSO的，Efecte身份或平联邦成员）可以与用于扩展名。

来源

2014-09-24 08:47:54

您需要有一个类来维护每个Idp的元数据列表 - 比如说您将这些元数据放入某个列表中，这些元数据将通过静态方法在应用程序之间共享。我有类似下面注意 - 我不是复制所有的类，因为它是我有，所以横跨你应该能够解决你自己的小问题可能会来到，

public class SSOMetadataProvider { 
    public static List<MetadataProvider> metadataList() throws MetadataProviderException, XMLParserException, IOException, Exception {    
      logger.info("Starting : Loading Metadata Data for all SSO enabled companies..."); 
      List<MetadataProvider> metadataList = new ArrayList<MetadataProvider>(); 
      org.opensaml.xml.parse.StaticBasicParserPool parserPool = new org.opensaml.xml.parse.StaticBasicParserPool(); 
      parserPool.initialize(); 

      //Get XML from DB -> convertIntoInputStream -> pass below as const argument 
      InputStreamMetadataProvider inputStreamMetadata = null; 
      try { 
     //Getting list from DB 
       List companyList = someServiceClass.getAllSSOEnabledCompanyDTO(); 

       if(companyList!=null){ 
        for (Object obj : companyList) { 
         CompanyDTO companyDTO = (CompanyDTO) obj; 
         if (companyDTO != null && companyDTO.getCompanyid() > 0 && companyDTO.getSsoSettingsDTO()!=null && !StringUtil.isNullOrEmpty(companyDTO.getSsoSettingsDTO().getSsoMetadataXml())) { 
          logger.info("Loading Metadata for Company : "+companyDTO.getCompanyname()+" , companyId : "+companyDTO.getCompanyid()); 

          inputStreamMetadata = new InputStreamMetadataProvider(companyDTO.getSsoSettingsDTO().getSsoMetadataXml()); 
          inputStreamMetadata.setParserPool(parserPool); 
          inputStreamMetadata.initialize(); 


          //ExtendedMetadataDelegateWrapper extMetadaDel = new ExtendedMetadataDelegateWrapper(inputStreamMetadata , new org.springframework.security.saml.metadata.ExtendedMetadata()); 

          SSOMetadataDelegate extMetadaDel = new SSOMetadataDelegate(inputStreamMetadata , new org.springframework.security.saml.metadata.ExtendedMetadata()) ; 

          extMetadaDel.initialize(); 
          extMetadaDel.setTrustFiltersInitialized(true); 
          metadataList.add(extMetadaDel); 

          logger.info("Loading Metadata bla bla"); 


         } 
        } 
       } 

      } catch (MetadataProviderException | IOException | XMLParserException mpe){ 

       logger.warn(mpe); 
       throw mpe; 
      } 
      catch (Exception e) { 
       logger.warn(e); 
      } 

      logger.info("Finished : Loading Metadata Data for all SSO enabled companies..."); 

      return metadataList; 
     }

InputStreamMetadataProvider.java

public class InputStreamMetadataProvider extends AbstractReloadingMetadataProvider implements Serializable 
    { 
    public InputStreamMetadataProvider(String metadata) throws MetadataProviderException 
     { 
      super(); 
      //metadataInputStream = metadata; 
      metadataInputStream = SSOUtil.getIdpAsStream(metadata); 

     } 
@Override 
    protected byte[] fetchMetadata() throws MetadataProviderException 
    { 
     byte[] metadataBytes = metadataInputStream ; 

     if(metadataBytes.length>0) 
       return metadataBytes; 
     else 
      return null; 
    } 
public byte[] getMetadataInputStream() { 
    return metadataInputStream; 
} 
}

SSOUtil.java

public class SSOUtil { 

    public static byte[] getIdpAsStream(String metadatXml) { 


      return metadatXml.getBytes(); 


     } 

}

后用户请求获取对他们公司的元数据元数据，获得元数据ENTITYID每个国内流离失所者 - SSOCachingMetadataManager.java

public class SSOCachingMetadataManager extends CachingMetadataManager{ 

@Override 
    public ExtendedMetadata getExtendedMetadata(String entityID) throws MetadataProviderException { 
     ExtendedMetadata extendedMetadata = null; 

     try { 


      //UAT Defect Fix - org.springframework.security.saml.metadata.ExtendedMetadataDelegate cannot be cast to biz.bsite.direct.spring.app.sso.ExtendedMetadataDelegate 
      //List<MetadataProvider> metadataList = (List<MetadataProvider>) GenericCache.getInstance().getCachedObject("ssoMetadataList", List.class.getClassLoader()); 

      List<MetadataProvider> metadataList = SSOMetadataProvider.metadataList(); 

      log.info("Retrieved Metadata List from Cassendra Cache size is :"+ (metadataList!=null ? metadataList.size(): 0)); 

      org.opensaml.xml.parse.StaticBasicParserPool parserPool = new org.opensaml.xml.parse.StaticBasicParserPool(); 
      parserPool.initialize(); 

      if(metadataList!=null){ 



       //metadataList.addAll(getAvailableProviders()); 
       //metadataList.addAll(getProviders()); 

       //To remove duplicate entries from list, if any 
       Set<MetadataProvider> hs = new HashSet<MetadataProvider>(); 
       hs.addAll(metadataList); 

       metadataList.clear(); 
       metadataList.addAll(hs); 
       //setAllProviders(metadataList); 
       //setTrustFilterInitializedToTrue(); 
       //refreshMetadata(); 

      } 


      if(metadataList!=null && metadataList.size()>0) { 

       for(MetadataProvider metadataProvider : metadataList){ 


         log.info("metadataProvider instance of ExtendedMetadataDelegate: Looking for entityId"+entityID); 

         SSOMetadataDelegate ssoMetadataDelegate = null;      
         ExtendedMetadataDelegateWrapper extMetadaDel = null; 

//      extMetadaDel.getDelegate() 
         if(metadataProvider instanceof SSOMetadataDelegate) 
          {ssoMetadataDelegate = (SSOMetadataDelegate) metadataProvider; 

           ((InputStreamMetadataProvider)ssoMetadataDelegate.getDelegate()).setParserPool(parserPool); 
           ((InputStreamMetadataProvider)ssoMetadataDelegate.getDelegate()).initialize(); 
           ssoMetadataDelegate.initialize(); 

           ssoMetadataDelegate.setTrustFiltersInitialized(true); 

           if(!isMetadataAlreadyExist(ssoMetadataDelegate)) 
            addMetadataProvider(ssoMetadataDelegate); 

           extMetadaDel = new ExtendedMetadataDelegateWrapper(ssoMetadataDelegate.getDelegate() , new org.springframework.security.saml.metadata.ExtendedMetadata()); 
          } 
         else 
          extMetadaDel = new ExtendedMetadataDelegateWrapper(metadataProvider, new org.springframework.security.saml.metadata.ExtendedMetadata()); 


         extMetadaDel.initialize(); 
         extMetadaDel.setTrustFiltersInitialized(true); 

         extMetadaDel.initialize(); 

         refreshMetadata(); 

         extendedMetadata = extMetadaDel.getExtendedMetadata(entityID); 

       } 
     } 

     } catch (Exception e) { 
      // TODO Auto-generated catch block 
      e.printStackTrace(); 
     } 

     if(extendedMetadata!=null) 
      return extendedMetadata; 
     else{ 
      return super.getExtendedMetadata(entityID);       
     } 
    } 



    private boolean isMetadataAlreadyExist(SSOMetadataDelegate ssoMetadataDelegate) { 

     boolean isExist = false; 
      for(ExtendedMetadataDelegate item : getAvailableProviders()){ 

        if (item.getDelegate() != null && item.getDelegate() instanceof SSOMetadataDelegate) { 

         SSOMetadataDelegate that = (SSOMetadataDelegate) item.getDelegate(); 
         try { 

          log.info("This Entity ID: "+ssoMetadataDelegate.getMetadata()!=null ? ((EntityDescriptorImpl)ssoMetadataDelegate.getMetadata()).getEntityID() : "nullEntity"+ 

            "That Entity ID: "+that.getMetadata()!=null ? ((EntityDescriptorImpl)that.getMetadata()).getEntityID() : "nullEntity"); 

          EntityDescriptorImpl e = (EntityDescriptorImpl) that.getMetadata(); 

         isExist = this.getMetadata()!=null ? ((EntityDescriptorImpl)ssoMetadataDelegate.getMetadata()).getEntityID().equals(e.getEntityID()) : false; 

          if(isExist) 
           return isExist; 
         } catch (MetadataProviderException e1) { 
          // TODO Auto-generated catch block 
          e1.printStackTrace(); 
         } 

       } 

      } 
      return isExist; 

    }

在乌拉圭回合的Spring bean XML条目添加

<bean id="metadata" class="pkg.path.SSOCachingMetadataManager"> 
     <constructor-arg name="providers" value="#{ssoMetadataProvider.metadataList()}"> 
     </constructor-arg> 
     <property name="RefreshCheckInterval" value="-1"/> 
     <property name="RefreshRequired" value="false"/> 
</bean>

让我知道柜面的任何疑虑。

来源

2017-06-29 04:05:09

用于多个IDP的弹簧SAML扩展

回答

相关问题