mirror of
https://github.com/spring-projects/spring-boot.git
synced 2024-08-29 03:06:45 +08:00
Merge branch '2.7.x'
This commit is contained in:
commit
1950d06585
@ -136,8 +136,21 @@ class ManagementWebSecurityAutoConfigurationTests {
|
|||||||
void backOffIfSaml2RelyingPartyAutoConfigurationPresent() {
|
void backOffIfSaml2RelyingPartyAutoConfigurationPresent() {
|
||||||
this.contextRunner.withConfiguration(AutoConfigurations.of(Saml2RelyingPartyAutoConfiguration.class))
|
this.contextRunner.withConfiguration(AutoConfigurations.of(Saml2RelyingPartyAutoConfiguration.class))
|
||||||
.withPropertyValues(
|
.withPropertyValues(
|
||||||
"spring.security.saml2.relyingparty.registration.simplesamlphp.identity-provider.single-sign-on.url=https://simplesaml-for-spring-saml/SSOService.php",
|
"spring.security.saml2.relyingparty.registration.simplesamlphp.asserting-party.single-sign-on.url=https://simplesaml-for-spring-saml/SSOService.php",
|
||||||
"spring.security.saml2.relyingparty.registration.simplesamlphp.identity-provider.single-sign-on.sign-request=false",
|
"spring.security.saml2.relyingparty.registration.simplesamlphp.asserting-party.single-sign-on.sign-request=false",
|
||||||
|
"spring.security.saml2.relyingparty.registration.simplesamlphp.asserting-party.entity-id=https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/metadata.php",
|
||||||
|
"spring.security.saml2.relyingparty.registration.simplesamlphp.asserting-party.verification.credentials[0].certificate-location=classpath:saml/certificate-location")
|
||||||
|
.run((context) -> assertThat(context).doesNotHaveBean(ManagementWebSecurityAutoConfiguration.class)
|
||||||
|
.doesNotHaveBean(MANAGEMENT_SECURITY_FILTER_CHAIN_BEAN));
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
@Deprecated
|
||||||
|
void backOffIfSaml2RelyingPartyAutoConfigurationPresentDeprecated() {
|
||||||
|
this.contextRunner.withConfiguration(AutoConfigurations.of(Saml2RelyingPartyAutoConfiguration.class))
|
||||||
|
.withPropertyValues(
|
||||||
|
"spring.security.saml2.relyingparty.registration.simplesamlphp.identityprovider.single-sign-on.url=https://simplesaml-for-spring-saml/SSOService.php",
|
||||||
|
"spring.security.saml2.relyingparty.registration.simplesamlphp.identityprovider.single-sign-on.sign-request=false",
|
||||||
"spring.security.saml2.relyingparty.registration.simplesamlphp.identityprovider.entity-id=https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/metadata.php",
|
"spring.security.saml2.relyingparty.registration.simplesamlphp.identityprovider.entity-id=https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/metadata.php",
|
||||||
"spring.security.saml2.relyingparty.registration.simplesamlphp.identityprovider.verification.credentials[0].certificate-location=classpath:saml/certificate-location")
|
"spring.security.saml2.relyingparty.registration.simplesamlphp.identityprovider.verification.credentials[0].certificate-location=classpath:saml/certificate-location")
|
||||||
.run((context) -> assertThat(context).doesNotHaveBean(ManagementWebSecurityAutoConfiguration.class)
|
.run((context) -> assertThat(context).doesNotHaveBean(ManagementWebSecurityAutoConfiguration.class)
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
/*
|
/*
|
||||||
* Copyright 2012-2021 the original author or authors.
|
* Copyright 2012-2022 the original author or authors.
|
||||||
*
|
*
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
* you may not use this file except in compliance with the License.
|
* you may not use this file except in compliance with the License.
|
||||||
@ -67,7 +67,14 @@ public class Saml2RelyingPartyProperties {
|
|||||||
/**
|
/**
|
||||||
* Remote SAML Identity Provider.
|
* Remote SAML Identity Provider.
|
||||||
*/
|
*/
|
||||||
private final Identityprovider identityprovider = new Identityprovider();
|
private final AssertingParty assertingParty = new AssertingParty();
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Remote SAML Identity Provider.
|
||||||
|
* @deprecated use {@link #assertingParty}
|
||||||
|
*/
|
||||||
|
@Deprecated
|
||||||
|
private final AssertingParty identityprovider = new AssertingParty();
|
||||||
|
|
||||||
public String getEntityId() {
|
public String getEntityId() {
|
||||||
return this.entityId;
|
return this.entityId;
|
||||||
@ -89,7 +96,17 @@ public class Saml2RelyingPartyProperties {
|
|||||||
return this.decryption;
|
return this.decryption;
|
||||||
}
|
}
|
||||||
|
|
||||||
public Identityprovider getIdentityprovider() {
|
public AssertingParty getAssertingParty() {
|
||||||
|
return this.assertingParty;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Remote SAML Identity Provider.
|
||||||
|
* @return remote SAML Identity Provider
|
||||||
|
* @deprecated use {@link #getAssertingParty()}
|
||||||
|
*/
|
||||||
|
@Deprecated
|
||||||
|
public AssertingParty getIdentityprovider() {
|
||||||
return this.identityprovider;
|
return this.identityprovider;
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -224,7 +241,7 @@ public class Saml2RelyingPartyProperties {
|
|||||||
/**
|
/**
|
||||||
* Represents a remote Identity Provider.
|
* Represents a remote Identity Provider.
|
||||||
*/
|
*/
|
||||||
public static class Identityprovider {
|
public static class AssertingParty {
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Unique identifier for the identity provider.
|
* Unique identifier for the identity provider.
|
||||||
@ -282,7 +299,7 @@ public class Saml2RelyingPartyProperties {
|
|||||||
/**
|
/**
|
||||||
* Whether to sign authentication requests.
|
* Whether to sign authentication requests.
|
||||||
*/
|
*/
|
||||||
private boolean signRequest = true;
|
private Boolean signRequest;
|
||||||
|
|
||||||
public String getUrl() {
|
public String getUrl() {
|
||||||
return this.url;
|
return this.url;
|
||||||
@ -304,7 +321,11 @@ public class Saml2RelyingPartyProperties {
|
|||||||
return this.signRequest;
|
return this.signRequest;
|
||||||
}
|
}
|
||||||
|
|
||||||
public void setSignRequest(boolean signRequest) {
|
public Boolean getSignRequest() {
|
||||||
|
return this.signRequest;
|
||||||
|
}
|
||||||
|
|
||||||
|
public void setSignRequest(Boolean signRequest) {
|
||||||
this.signRequest = signRequest;
|
this.signRequest = signRequest;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
/*
|
/*
|
||||||
* Copyright 2012-2021 the original author or authors.
|
* Copyright 2012-2022 the original author or authors.
|
||||||
*
|
*
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
* you may not use this file except in compliance with the License.
|
* you may not use this file except in compliance with the License.
|
||||||
@ -23,11 +23,16 @@ import java.security.interfaces.RSAPrivateKey;
|
|||||||
import java.util.List;
|
import java.util.List;
|
||||||
import java.util.Map;
|
import java.util.Map;
|
||||||
import java.util.function.Consumer;
|
import java.util.function.Consumer;
|
||||||
|
import java.util.function.Function;
|
||||||
import java.util.stream.Collectors;
|
import java.util.stream.Collectors;
|
||||||
|
|
||||||
|
import org.apache.commons.logging.Log;
|
||||||
|
import org.apache.commons.logging.LogFactory;
|
||||||
|
|
||||||
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
|
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
|
||||||
|
import org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyProperties.AssertingParty;
|
||||||
|
import org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyProperties.AssertingParty.Verification;
|
||||||
import org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyProperties.Decryption;
|
import org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyProperties.Decryption;
|
||||||
import org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyProperties.Identityprovider.Verification;
|
|
||||||
import org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyProperties.Registration;
|
import org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyProperties.Registration;
|
||||||
import org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyProperties.Registration.Signing;
|
import org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyProperties.Registration.Signing;
|
||||||
import org.springframework.boot.context.properties.PropertyMapper;
|
import org.springframework.boot.context.properties.PropertyMapper;
|
||||||
@ -59,6 +64,8 @@ import org.springframework.util.StringUtils;
|
|||||||
@ConditionalOnMissingBean(RelyingPartyRegistrationRepository.class)
|
@ConditionalOnMissingBean(RelyingPartyRegistrationRepository.class)
|
||||||
class Saml2RelyingPartyRegistrationConfiguration {
|
class Saml2RelyingPartyRegistrationConfiguration {
|
||||||
|
|
||||||
|
private static final Log logger = LogFactory.getLog(Saml2RelyingPartyRegistrationConfiguration.class);
|
||||||
|
|
||||||
@Bean
|
@Bean
|
||||||
RelyingPartyRegistrationRepository relyingPartyRegistrationRepository(Saml2RelyingPartyProperties properties) {
|
RelyingPartyRegistrationRepository relyingPartyRegistrationRepository(Saml2RelyingPartyProperties properties) {
|
||||||
List<RelyingPartyRegistration> registrations = properties.getRegistration().entrySet().stream()
|
List<RelyingPartyRegistration> registrations = properties.getRegistration().entrySet().stream()
|
||||||
@ -71,19 +78,21 @@ class Saml2RelyingPartyRegistrationConfiguration {
|
|||||||
}
|
}
|
||||||
|
|
||||||
private RelyingPartyRegistration asRegistration(String id, Registration properties) {
|
private RelyingPartyRegistration asRegistration(String id, Registration properties) {
|
||||||
boolean usingMetadata = StringUtils.hasText(properties.getIdentityprovider().getMetadataUri());
|
boolean usingMetadata = StringUtils
|
||||||
|
.hasText(getFromAssertingParty(properties, id, "metadata-uri", AssertingParty::getMetadataUri));
|
||||||
Builder builder = (usingMetadata) ? RelyingPartyRegistrations
|
Builder builder = (usingMetadata) ? RelyingPartyRegistrations
|
||||||
.fromMetadataLocation(properties.getIdentityprovider().getMetadataUri()).registrationId(id)
|
.fromMetadataLocation(
|
||||||
: RelyingPartyRegistration.withRegistrationId(id);
|
getFromAssertingParty(properties, id, "metadata-uri", AssertingParty::getMetadataUri))
|
||||||
|
.registrationId(id) : RelyingPartyRegistration.withRegistrationId(id);
|
||||||
builder.assertionConsumerServiceLocation(properties.getAcs().getLocation());
|
builder.assertionConsumerServiceLocation(properties.getAcs().getLocation());
|
||||||
builder.assertionConsumerServiceBinding(properties.getAcs().getBinding());
|
builder.assertionConsumerServiceBinding(properties.getAcs().getBinding());
|
||||||
builder.assertingPartyDetails(mapIdentityProvider(properties, usingMetadata));
|
builder.assertingPartyDetails(mapAssertingParty(properties, id, usingMetadata));
|
||||||
builder.signingX509Credentials((credentials) -> properties.getSigning().getCredentials().stream()
|
builder.signingX509Credentials((credentials) -> properties.getSigning().getCredentials().stream()
|
||||||
.map(this::asSigningCredential).forEach(credentials::add));
|
.map(this::asSigningCredential).forEach(credentials::add));
|
||||||
builder.decryptionX509Credentials((credentials) -> properties.getDecryption().getCredentials().stream()
|
builder.decryptionX509Credentials((credentials) -> properties.getDecryption().getCredentials().stream()
|
||||||
.map(this::asDecryptionCredential).forEach(credentials::add));
|
.map(this::asDecryptionCredential).forEach(credentials::add));
|
||||||
builder.assertingPartyDetails((details) -> details
|
builder.assertingPartyDetails((details) -> details.verificationX509Credentials(
|
||||||
.verificationX509Credentials((credentials) -> properties.getIdentityprovider().getVerification()
|
(credentials) -> getFromAssertingParty(properties, id, "verification", AssertingParty::getVerification)
|
||||||
.getCredentials().stream().map(this::asVerificationCredential).forEach(credentials::add)));
|
.getCredentials().stream().map(this::asVerificationCredential).forEach(credentials::add)));
|
||||||
builder.entityId(properties.getEntityId());
|
builder.entityId(properties.getEntityId());
|
||||||
RelyingPartyRegistration registration = builder.build();
|
RelyingPartyRegistration registration = builder.build();
|
||||||
@ -92,16 +101,35 @@ class Saml2RelyingPartyRegistrationConfiguration {
|
|||||||
return registration;
|
return registration;
|
||||||
}
|
}
|
||||||
|
|
||||||
private Consumer<AssertingPartyDetails.Builder> mapIdentityProvider(Registration properties,
|
@SuppressWarnings("deprecation")
|
||||||
|
private <T> T getFromAssertingParty(Registration registration, String id, String name,
|
||||||
|
Function<AssertingParty, T> getter) {
|
||||||
|
T newValue = getter.apply(registration.getAssertingParty());
|
||||||
|
if (newValue != null) {
|
||||||
|
return newValue;
|
||||||
|
}
|
||||||
|
T deprecatedValue = getter.apply(registration.getIdentityprovider());
|
||||||
|
if (deprecatedValue != null) {
|
||||||
|
logger.warn(String.format(
|
||||||
|
"Property 'spring.security.saml2.relyingparty.registration.identityprovider.%1$s.%2$s' is deprecated, please use 'spring.security.saml2.relyingparty.registration.asserting-party.%1$s.%2$s' instead",
|
||||||
|
id, name));
|
||||||
|
return deprecatedValue;
|
||||||
|
}
|
||||||
|
return newValue;
|
||||||
|
}
|
||||||
|
|
||||||
|
private Consumer<AssertingPartyDetails.Builder> mapAssertingParty(Registration registration, String id,
|
||||||
boolean usingMetadata) {
|
boolean usingMetadata) {
|
||||||
PropertyMapper map = PropertyMapper.get().alwaysApplyingWhenNonNull();
|
PropertyMapper map = PropertyMapper.get().alwaysApplyingWhenNonNull();
|
||||||
Saml2RelyingPartyProperties.Identityprovider identityprovider = properties.getIdentityprovider();
|
|
||||||
return (details) -> {
|
return (details) -> {
|
||||||
map.from(identityprovider::getEntityId).to(details::entityId);
|
map.from(() -> getFromAssertingParty(registration, id, "entity-id", AssertingParty::getEntityId))
|
||||||
map.from(identityprovider.getSinglesignon()::getBinding).whenNonNull()
|
.to(details::entityId);
|
||||||
.to(details::singleSignOnServiceBinding);
|
map.from(() -> getFromAssertingParty(registration, id, "singlesignon.binding",
|
||||||
map.from(identityprovider.getSinglesignon()::getUrl).to(details::singleSignOnServiceLocation);
|
(property) -> property.getSinglesignon().getBinding())).to(details::singleSignOnServiceBinding);
|
||||||
map.from(identityprovider.getSinglesignon()::isSignRequest).when((signRequest) -> !usingMetadata)
|
map.from(() -> getFromAssertingParty(registration, id, "singlesignon.url",
|
||||||
|
(property) -> property.getSinglesignon().getUrl())).to(details::singleSignOnServiceLocation);
|
||||||
|
map.from(() -> getFromAssertingParty(registration, id, "singlesignon.sign-request",
|
||||||
|
(property) -> property.getSinglesignon().getSignRequest())).when((ignored) -> !usingMetadata)
|
||||||
.to(details::wantAuthnRequestsSigned);
|
.to(details::wantAuthnRequestsSigned);
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
@ -62,7 +62,15 @@ class Saml2RelyingPartyAutoConfigurationTests {
|
|||||||
|
|
||||||
@Test
|
@Test
|
||||||
void autoConfigurationShouldBeConditionalOnRelyingPartyRegistrationRepositoryClass() {
|
void autoConfigurationShouldBeConditionalOnRelyingPartyRegistrationRepositoryClass() {
|
||||||
this.contextRunner.withPropertyValues(getPropertyValues()).withClassLoader(new FilteredClassLoader(
|
this.contextRunner.withPropertyValues(getPropertyValues(false)).withClassLoader(new FilteredClassLoader(
|
||||||
|
"org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository"))
|
||||||
|
.run((context) -> assertThat(context).doesNotHaveBean(RelyingPartyRegistrationRepository.class));
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
@Deprecated
|
||||||
|
void autoConfigurationShouldBeConditionalOnRelyingPartyRegistrationRepositoryClassDeprecated() {
|
||||||
|
this.contextRunner.withPropertyValues(getPropertyValues(true)).withClassLoader(new FilteredClassLoader(
|
||||||
"org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository"))
|
"org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository"))
|
||||||
.run((context) -> assertThat(context).doesNotHaveBean(RelyingPartyRegistrationRepository.class));
|
.run((context) -> assertThat(context).doesNotHaveBean(RelyingPartyRegistrationRepository.class));
|
||||||
}
|
}
|
||||||
@ -71,7 +79,16 @@ class Saml2RelyingPartyAutoConfigurationTests {
|
|||||||
void autoConfigurationShouldBeConditionalOnServletWebApplication() {
|
void autoConfigurationShouldBeConditionalOnServletWebApplication() {
|
||||||
new ApplicationContextRunner()
|
new ApplicationContextRunner()
|
||||||
.withConfiguration(AutoConfigurations.of(Saml2RelyingPartyAutoConfiguration.class))
|
.withConfiguration(AutoConfigurations.of(Saml2RelyingPartyAutoConfiguration.class))
|
||||||
.withPropertyValues(getPropertyValues())
|
.withPropertyValues(getPropertyValues(false))
|
||||||
|
.run((context) -> assertThat(context).doesNotHaveBean(RelyingPartyRegistrationRepository.class));
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
@Deprecated
|
||||||
|
void autoConfigurationShouldBeConditionalOnServletWebApplicationDeprecated() {
|
||||||
|
new ApplicationContextRunner()
|
||||||
|
.withConfiguration(AutoConfigurations.of(Saml2RelyingPartyAutoConfiguration.class))
|
||||||
|
.withPropertyValues(getPropertyValues(true))
|
||||||
.run((context) -> assertThat(context).doesNotHaveBean(RelyingPartyRegistrationRepository.class));
|
.run((context) -> assertThat(context).doesNotHaveBean(RelyingPartyRegistrationRepository.class));
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -83,7 +100,31 @@ class Saml2RelyingPartyAutoConfigurationTests {
|
|||||||
|
|
||||||
@Test
|
@Test
|
||||||
void relyingPartyRegistrationRepositoryBeanShouldBeCreatedWhenPropertiesPresent() {
|
void relyingPartyRegistrationRepositoryBeanShouldBeCreatedWhenPropertiesPresent() {
|
||||||
this.contextRunner.withPropertyValues(getPropertyValues()).run((context) -> {
|
this.contextRunner.withPropertyValues(getPropertyValues(false)).run((context) -> {
|
||||||
|
RelyingPartyRegistrationRepository repository = context.getBean(RelyingPartyRegistrationRepository.class);
|
||||||
|
RelyingPartyRegistration registration = repository.findByRegistrationId("foo");
|
||||||
|
|
||||||
|
assertThat(registration.getAssertingPartyDetails().getSingleSignOnServiceLocation())
|
||||||
|
.isEqualTo("https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/SSOService.php");
|
||||||
|
assertThat(registration.getAssertingPartyDetails().getEntityId())
|
||||||
|
.isEqualTo("https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/metadata.php");
|
||||||
|
assertThat(registration.getAssertionConsumerServiceLocation())
|
||||||
|
.isEqualTo("{baseUrl}/login/saml2/foo-entity-id");
|
||||||
|
assertThat(registration.getAssertionConsumerServiceBinding()).isEqualTo(Saml2MessageBinding.REDIRECT);
|
||||||
|
assertThat(registration.getAssertingPartyDetails().getSingleSignOnServiceBinding())
|
||||||
|
.isEqualTo(Saml2MessageBinding.POST);
|
||||||
|
assertThat(registration.getAssertingPartyDetails().getWantAuthnRequestsSigned()).isEqualTo(false);
|
||||||
|
assertThat(registration.getSigningX509Credentials()).hasSize(1);
|
||||||
|
assertThat(registration.getDecryptionX509Credentials()).hasSize(1);
|
||||||
|
assertThat(registration.getAssertingPartyDetails().getVerificationX509Credentials()).isNotNull();
|
||||||
|
assertThat(registration.getEntityId()).isEqualTo("{baseUrl}/saml2/foo-entity-id");
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
@Deprecated
|
||||||
|
void relyingPartyRegistrationRepositoryBeanShouldBeCreatedWhenPropertiesPresentDeprecated() {
|
||||||
|
this.contextRunner.withPropertyValues(getPropertyValues(true)).run((context) -> {
|
||||||
RelyingPartyRegistrationRepository repository = context.getBean(RelyingPartyRegistrationRepository.class);
|
RelyingPartyRegistrationRepository repository = context.getBean(RelyingPartyRegistrationRepository.class);
|
||||||
RelyingPartyRegistration registration = repository.findByRegistrationId("foo");
|
RelyingPartyRegistration registration = repository.findByRegistrationId("foo");
|
||||||
|
|
||||||
@ -106,7 +147,18 @@ class Saml2RelyingPartyAutoConfigurationTests {
|
|||||||
|
|
||||||
@Test
|
@Test
|
||||||
void autoConfigurationWhenSignRequestsTrueAndNoSigningCredentialsShouldThrowException() {
|
void autoConfigurationWhenSignRequestsTrueAndNoSigningCredentialsShouldThrowException() {
|
||||||
this.contextRunner.withPropertyValues(getPropertyValuesWithoutSigningCredentials(true)).run((context) -> {
|
this.contextRunner.withPropertyValues(getPropertyValuesWithoutSigningCredentials(true, false))
|
||||||
|
.run((context) -> {
|
||||||
|
assertThat(context).hasFailed();
|
||||||
|
assertThat(context.getStartupFailure()).hasMessageContaining(
|
||||||
|
"Signing credentials must not be empty when authentication requests require signing.");
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
@Deprecated
|
||||||
|
void autoConfigurationWhenSignRequestsTrueAndNoSigningCredentialsShouldThrowExceptionDeprecated() {
|
||||||
|
this.contextRunner.withPropertyValues(getPropertyValuesWithoutSigningCredentials(true, true)).run((context) -> {
|
||||||
assertThat(context).hasFailed();
|
assertThat(context).hasFailed();
|
||||||
assertThat(context.getStartupFailure()).hasMessageContaining(
|
assertThat(context.getStartupFailure()).hasMessageContaining(
|
||||||
"Signing credentials must not be empty when authentication requests require signing.");
|
"Signing credentials must not be empty when authentication requests require signing.");
|
||||||
@ -115,12 +167,34 @@ class Saml2RelyingPartyAutoConfigurationTests {
|
|||||||
|
|
||||||
@Test
|
@Test
|
||||||
void autoConfigurationWhenSignRequestsFalseAndNoSigningCredentialsShouldNotThrowException() {
|
void autoConfigurationWhenSignRequestsFalseAndNoSigningCredentialsShouldNotThrowException() {
|
||||||
this.contextRunner.withPropertyValues(getPropertyValuesWithoutSigningCredentials(false))
|
this.contextRunner.withPropertyValues(getPropertyValuesWithoutSigningCredentials(false, false))
|
||||||
.run((context) -> assertThat(context).hasSingleBean(RelyingPartyRegistrationRepository.class));
|
.run((context) -> assertThat(context).hasSingleBean(RelyingPartyRegistrationRepository.class));
|
||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
void autoconfigurationShouldQueryIdentityProviderMetadataWhenMetadataUrlIsPresent() throws Exception {
|
@Deprecated
|
||||||
|
void autoConfigurationWhenSignRequestsFalseAndNoSigningCredentialsShouldNotThrowExceptionDeprecated() {
|
||||||
|
this.contextRunner.withPropertyValues(getPropertyValuesWithoutSigningCredentials(false, true))
|
||||||
|
.run((context) -> assertThat(context).hasSingleBean(RelyingPartyRegistrationRepository.class));
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
void autoconfigurationShouldQueryAssertingPartyMetadataWhenMetadataUrlIsPresent() throws Exception {
|
||||||
|
try (MockWebServer server = new MockWebServer()) {
|
||||||
|
server.start();
|
||||||
|
String metadataUrl = server.url("").toString();
|
||||||
|
setupMockResponse(server, new ClassPathResource("saml/idp-metadata"));
|
||||||
|
this.contextRunner.withPropertyValues(PREFIX + ".foo.asserting-party.metadata-uri=" + metadataUrl)
|
||||||
|
.run((context) -> {
|
||||||
|
assertThat(context).hasSingleBean(RelyingPartyRegistrationRepository.class);
|
||||||
|
assertThat(server.getRequestCount()).isEqualTo(1);
|
||||||
|
});
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
@Deprecated
|
||||||
|
void autoconfigurationShouldQueryAssertingPartyMetadataWhenMetadataUrlIsPresentDeprecated() throws Exception {
|
||||||
try (MockWebServer server = new MockWebServer()) {
|
try (MockWebServer server = new MockWebServer()) {
|
||||||
server.start();
|
server.start();
|
||||||
String metadataUrl = server.url("").toString();
|
String metadataUrl = server.url("").toString();
|
||||||
@ -135,6 +209,24 @@ class Saml2RelyingPartyAutoConfigurationTests {
|
|||||||
|
|
||||||
@Test
|
@Test
|
||||||
void autoconfigurationShouldUseBindingFromMetadataUrlIfPresent() throws Exception {
|
void autoconfigurationShouldUseBindingFromMetadataUrlIfPresent() throws Exception {
|
||||||
|
try (MockWebServer server = new MockWebServer()) {
|
||||||
|
server.start();
|
||||||
|
String metadataUrl = server.url("").toString();
|
||||||
|
setupMockResponse(server, new ClassPathResource("saml/idp-metadata"));
|
||||||
|
this.contextRunner.withPropertyValues(PREFIX + ".foo.asserting-party.metadata-uri=" + metadataUrl)
|
||||||
|
.run((context) -> {
|
||||||
|
RelyingPartyRegistrationRepository repository = context
|
||||||
|
.getBean(RelyingPartyRegistrationRepository.class);
|
||||||
|
RelyingPartyRegistration registration = repository.findByRegistrationId("foo");
|
||||||
|
assertThat(registration.getAssertingPartyDetails().getSingleSignOnServiceBinding())
|
||||||
|
.isEqualTo(Saml2MessageBinding.POST);
|
||||||
|
});
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
@Deprecated
|
||||||
|
void autoconfigurationShouldUseBindingFromMetadataUrlIfPresentDeprecated() throws Exception {
|
||||||
try (MockWebServer server = new MockWebServer()) {
|
try (MockWebServer server = new MockWebServer()) {
|
||||||
server.start();
|
server.start();
|
||||||
String metadataUrl = server.url("").toString();
|
String metadataUrl = server.url("").toString();
|
||||||
@ -152,6 +244,24 @@ class Saml2RelyingPartyAutoConfigurationTests {
|
|||||||
|
|
||||||
@Test
|
@Test
|
||||||
void autoconfigurationWhenMetadataUrlAndPropertyPresentShouldUseBindingFromProperty() throws Exception {
|
void autoconfigurationWhenMetadataUrlAndPropertyPresentShouldUseBindingFromProperty() throws Exception {
|
||||||
|
try (MockWebServer server = new MockWebServer()) {
|
||||||
|
server.start();
|
||||||
|
String metadataUrl = server.url("").toString();
|
||||||
|
setupMockResponse(server, new ClassPathResource("saml/idp-metadata"));
|
||||||
|
this.contextRunner.withPropertyValues(PREFIX + ".foo.asserting-party.metadata-uri=" + metadataUrl,
|
||||||
|
PREFIX + ".foo.asserting-party.singlesignon.binding=redirect").run((context) -> {
|
||||||
|
RelyingPartyRegistrationRepository repository = context
|
||||||
|
.getBean(RelyingPartyRegistrationRepository.class);
|
||||||
|
RelyingPartyRegistration registration = repository.findByRegistrationId("foo");
|
||||||
|
assertThat(registration.getAssertingPartyDetails().getSingleSignOnServiceBinding())
|
||||||
|
.isEqualTo(Saml2MessageBinding.REDIRECT);
|
||||||
|
});
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
@Deprecated
|
||||||
|
void autoconfigurationWhenMetadataUrlAndPropertyPresentShouldUseBindingFromPropertyDeprecated() throws Exception {
|
||||||
try (MockWebServer server = new MockWebServer()) {
|
try (MockWebServer server = new MockWebServer()) {
|
||||||
server.start();
|
server.start();
|
||||||
String metadataUrl = server.url("").toString();
|
String metadataUrl = server.url("").toString();
|
||||||
@ -169,7 +279,18 @@ class Saml2RelyingPartyAutoConfigurationTests {
|
|||||||
|
|
||||||
@Test
|
@Test
|
||||||
void autoconfigurationWhenNoMetadataUrlOrPropertyPresentShouldUseRedirectBinding() {
|
void autoconfigurationWhenNoMetadataUrlOrPropertyPresentShouldUseRedirectBinding() {
|
||||||
this.contextRunner.withPropertyValues(getPropertyValuesWithoutSsoBinding()).run((context) -> {
|
this.contextRunner.withPropertyValues(getPropertyValuesWithoutSsoBinding(false)).run((context) -> {
|
||||||
|
RelyingPartyRegistrationRepository repository = context.getBean(RelyingPartyRegistrationRepository.class);
|
||||||
|
RelyingPartyRegistration registration = repository.findByRegistrationId("foo");
|
||||||
|
assertThat(registration.getAssertingPartyDetails().getSingleSignOnServiceBinding())
|
||||||
|
.isEqualTo(Saml2MessageBinding.REDIRECT);
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
@Deprecated
|
||||||
|
void autoconfigurationWhenNoMetadataUrlOrPropertyPresentShouldUseRedirectBindingDeprecated() {
|
||||||
|
this.contextRunner.withPropertyValues(getPropertyValuesWithoutSsoBinding(true)).run((context) -> {
|
||||||
RelyingPartyRegistrationRepository repository = context.getBean(RelyingPartyRegistrationRepository.class);
|
RelyingPartyRegistrationRepository repository = context.getBean(RelyingPartyRegistrationRepository.class);
|
||||||
RelyingPartyRegistration registration = repository.findByRegistrationId("foo");
|
RelyingPartyRegistration registration = repository.findByRegistrationId("foo");
|
||||||
assertThat(registration.getAssertingPartyDetails().getSingleSignOnServiceBinding())
|
assertThat(registration.getAssertingPartyDetails().getSingleSignOnServiceBinding())
|
||||||
@ -179,7 +300,17 @@ class Saml2RelyingPartyAutoConfigurationTests {
|
|||||||
|
|
||||||
@Test
|
@Test
|
||||||
void relyingPartyRegistrationRepositoryShouldBeConditionalOnMissingBean() {
|
void relyingPartyRegistrationRepositoryShouldBeConditionalOnMissingBean() {
|
||||||
this.contextRunner.withPropertyValues(getPropertyValues())
|
this.contextRunner.withPropertyValues(getPropertyValues(false))
|
||||||
|
.withUserConfiguration(RegistrationRepositoryConfiguration.class).run((context) -> {
|
||||||
|
assertThat(context).hasSingleBean(RelyingPartyRegistrationRepository.class);
|
||||||
|
assertThat(context).hasBean("testRegistrationRepository");
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
@Deprecated
|
||||||
|
void relyingPartyRegistrationRepositoryShouldBeConditionalOnMissingBeanDeprecated() {
|
||||||
|
this.contextRunner.withPropertyValues(getPropertyValues(true))
|
||||||
.withUserConfiguration(RegistrationRepositoryConfiguration.class).run((context) -> {
|
.withUserConfiguration(RegistrationRepositoryConfiguration.class).run((context) -> {
|
||||||
assertThat(context).hasSingleBean(RelyingPartyRegistrationRepository.class);
|
assertThat(context).hasSingleBean(RelyingPartyRegistrationRepository.class);
|
||||||
assertThat(context).hasBean("testRegistrationRepository");
|
assertThat(context).hasBean("testRegistrationRepository");
|
||||||
@ -188,59 +319,102 @@ class Saml2RelyingPartyAutoConfigurationTests {
|
|||||||
|
|
||||||
@Test
|
@Test
|
||||||
void samlLoginShouldBeConfigured() {
|
void samlLoginShouldBeConfigured() {
|
||||||
this.contextRunner.withPropertyValues(getPropertyValues())
|
this.contextRunner.withPropertyValues(getPropertyValues(false))
|
||||||
|
.run((context) -> assertThat(hasFilter(context, Saml2WebSsoAuthenticationFilter.class)).isTrue());
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
@Deprecated
|
||||||
|
void samlLoginShouldBeConfiguredDeprecated() {
|
||||||
|
this.contextRunner.withPropertyValues(getPropertyValues(true))
|
||||||
.run((context) -> assertThat(hasFilter(context, Saml2WebSsoAuthenticationFilter.class)).isTrue());
|
.run((context) -> assertThat(hasFilter(context, Saml2WebSsoAuthenticationFilter.class)).isTrue());
|
||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
void samlLoginShouldBackOffWhenAWebSecurityConfigurerAdapterIsDefined() {
|
void samlLoginShouldBackOffWhenAWebSecurityConfigurerAdapterIsDefined() {
|
||||||
this.contextRunner.withUserConfiguration(WebSecurityConfigurerAdapterConfiguration.class)
|
this.contextRunner.withUserConfiguration(WebSecurityConfigurerAdapterConfiguration.class)
|
||||||
.withPropertyValues(getPropertyValues())
|
.withPropertyValues(getPropertyValues(false))
|
||||||
|
.run((context) -> assertThat(hasFilter(context, Saml2WebSsoAuthenticationFilter.class)).isFalse());
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
@Deprecated
|
||||||
|
void samlLoginShouldBackOffWhenAWebSecurityConfigurerAdapterIsDefinedDeprecated() {
|
||||||
|
this.contextRunner.withUserConfiguration(WebSecurityConfigurerAdapterConfiguration.class)
|
||||||
|
.withPropertyValues(getPropertyValues(true))
|
||||||
.run((context) -> assertThat(hasFilter(context, Saml2WebSsoAuthenticationFilter.class)).isFalse());
|
.run((context) -> assertThat(hasFilter(context, Saml2WebSsoAuthenticationFilter.class)).isFalse());
|
||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
void samlLoginShouldBackOffWhenASecurityFilterChainBeanIsPresent() {
|
void samlLoginShouldBackOffWhenASecurityFilterChainBeanIsPresent() {
|
||||||
this.contextRunner.withUserConfiguration(TestSecurityFilterChainConfig.class)
|
this.contextRunner.withUserConfiguration(TestSecurityFilterChainConfig.class)
|
||||||
.withPropertyValues(getPropertyValues())
|
.withPropertyValues(getPropertyValues(false))
|
||||||
|
.run((context) -> assertThat(hasFilter(context, Saml2WebSsoAuthenticationFilter.class)).isFalse());
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
@Deprecated
|
||||||
|
void samlLoginShouldBackOffWhenASecurityFilterChainBeanIsPresentDeprecated() {
|
||||||
|
this.contextRunner.withUserConfiguration(TestSecurityFilterChainConfig.class)
|
||||||
|
.withPropertyValues(getPropertyValues(true))
|
||||||
.run((context) -> assertThat(hasFilter(context, Saml2WebSsoAuthenticationFilter.class)).isFalse());
|
.run((context) -> assertThat(hasFilter(context, Saml2WebSsoAuthenticationFilter.class)).isFalse());
|
||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
void samlLoginShouldShouldBeConditionalOnSecurityWebFilterClass() {
|
void samlLoginShouldShouldBeConditionalOnSecurityWebFilterClass() {
|
||||||
this.contextRunner.withClassLoader(new FilteredClassLoader(SecurityFilterChain.class))
|
this.contextRunner.withClassLoader(new FilteredClassLoader(SecurityFilterChain.class))
|
||||||
.withPropertyValues(getPropertyValues())
|
.withPropertyValues(getPropertyValues(false))
|
||||||
.run((context) -> assertThat(context).doesNotHaveBean(SecurityFilterChain.class));
|
.run((context) -> assertThat(context).doesNotHaveBean(SecurityFilterChain.class));
|
||||||
}
|
}
|
||||||
|
|
||||||
private String[] getPropertyValuesWithoutSigningCredentials(boolean signRequests) {
|
@Test
|
||||||
return new String[] { PREFIX
|
@Deprecated
|
||||||
+ ".foo.identityprovider.singlesignon.url=https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/SSOService.php",
|
void samlLoginShouldShouldBeConditionalOnSecurityWebFilterClassDeprecated() {
|
||||||
PREFIX + ".foo.identityprovider.singlesignon.binding=post",
|
this.contextRunner.withClassLoader(new FilteredClassLoader(SecurityFilterChain.class))
|
||||||
PREFIX + ".foo.identityprovider.singlesignon.sign-request=" + signRequests,
|
.withPropertyValues(getPropertyValues(true))
|
||||||
PREFIX + ".foo.identityprovider.entity-id=https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/metadata.php",
|
.run((context) -> assertThat(context).doesNotHaveBean(SecurityFilterChain.class));
|
||||||
PREFIX + ".foo.identityprovider.verification.credentials[0].certificate-location=classpath:saml/certificate-location" };
|
|
||||||
}
|
}
|
||||||
|
|
||||||
private String[] getPropertyValuesWithoutSsoBinding() {
|
private String[] getPropertyValuesWithoutSigningCredentials(boolean signRequests, boolean useDeprecated) {
|
||||||
return new String[] { PREFIX
|
String assertingParty = useDeprecated ? "identityprovider" : "asserting-party";
|
||||||
+ ".foo.identityprovider.singlesignon.url=https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/SSOService.php",
|
return new String[] {
|
||||||
PREFIX + ".foo.identityprovider.singlesignon.sign-request=false",
|
PREFIX + ".foo." + assertingParty
|
||||||
PREFIX + ".foo.identityprovider.entity-id=https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/metadata.php",
|
+ ".singlesignon.url=https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/SSOService.php",
|
||||||
PREFIX + ".foo.identityprovider.verification.credentials[0].certificate-location=classpath:saml/certificate-location" };
|
PREFIX + ".foo." + assertingParty + ".singlesignon.binding=post",
|
||||||
|
PREFIX + ".foo." + assertingParty + ".singlesignon.sign-request=" + signRequests,
|
||||||
|
PREFIX + ".foo." + assertingParty
|
||||||
|
+ ".entity-id=https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/metadata.php",
|
||||||
|
PREFIX + ".foo." + assertingParty
|
||||||
|
+ ".verification.credentials[0].certificate-location=classpath:saml/certificate-location" };
|
||||||
}
|
}
|
||||||
|
|
||||||
private String[] getPropertyValues() {
|
private String[] getPropertyValuesWithoutSsoBinding(boolean useDeprecated) {
|
||||||
|
String assertingParty = useDeprecated ? "identityprovider" : "asserting-party";
|
||||||
|
return new String[] {
|
||||||
|
PREFIX + ".foo." + assertingParty
|
||||||
|
+ ".singlesignon.url=https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/SSOService.php",
|
||||||
|
PREFIX + ".foo." + assertingParty + ".singlesignon.sign-request=false",
|
||||||
|
PREFIX + ".foo." + assertingParty
|
||||||
|
+ ".entity-id=https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/metadata.php",
|
||||||
|
PREFIX + ".foo." + assertingParty
|
||||||
|
+ ".verification.credentials[0].certificate-location=classpath:saml/certificate-location" };
|
||||||
|
}
|
||||||
|
|
||||||
|
private String[] getPropertyValues(boolean useDeprecated) {
|
||||||
|
String assertingParty = useDeprecated ? "identityprovider" : "asserting-party";
|
||||||
return new String[] {
|
return new String[] {
|
||||||
PREFIX + ".foo.signing.credentials[0].private-key-location=classpath:saml/private-key-location",
|
PREFIX + ".foo.signing.credentials[0].private-key-location=classpath:saml/private-key-location",
|
||||||
PREFIX + ".foo.signing.credentials[0].certificate-location=classpath:saml/certificate-location",
|
PREFIX + ".foo.signing.credentials[0].certificate-location=classpath:saml/certificate-location",
|
||||||
PREFIX + ".foo.decryption.credentials[0].private-key-location=classpath:saml/private-key-location",
|
PREFIX + ".foo.decryption.credentials[0].private-key-location=classpath:saml/private-key-location",
|
||||||
PREFIX + ".foo.decryption.credentials[0].certificate-location=classpath:saml/certificate-location",
|
PREFIX + ".foo.decryption.credentials[0].certificate-location=classpath:saml/certificate-location",
|
||||||
PREFIX + ".foo.identityprovider.singlesignon.url=https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/SSOService.php",
|
PREFIX + ".foo." + assertingParty
|
||||||
PREFIX + ".foo.identityprovider.singlesignon.binding=post",
|
+ ".singlesignon.url=https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/SSOService.php",
|
||||||
PREFIX + ".foo.identityprovider.singlesignon.sign-request=false",
|
PREFIX + ".foo." + assertingParty + ".singlesignon.binding=post",
|
||||||
PREFIX + ".foo.identityprovider.entity-id=https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/metadata.php",
|
PREFIX + ".foo." + assertingParty + ".singlesignon.sign-request=false",
|
||||||
PREFIX + ".foo.identityprovider.verification.credentials[0].certificate-location=classpath:saml/certificate-location",
|
PREFIX + ".foo." + assertingParty
|
||||||
|
+ ".entity-id=https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/metadata.php",
|
||||||
|
PREFIX + ".foo." + assertingParty
|
||||||
|
+ ".verification.credentials[0].certificate-location=classpath:saml/certificate-location",
|
||||||
PREFIX + ".foo.entity-id={baseUrl}/saml2/foo-entity-id",
|
PREFIX + ".foo.entity-id={baseUrl}/saml2/foo-entity-id",
|
||||||
PREFIX + ".foo.acs.location={baseUrl}/login/saml2/foo-entity-id",
|
PREFIX + ".foo.acs.location={baseUrl}/login/saml2/foo-entity-id",
|
||||||
PREFIX + ".foo.acs.binding=redirect" };
|
PREFIX + ".foo.acs.binding=redirect" };
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
/*
|
/*
|
||||||
* Copyright 2012-2021 the original author or authors.
|
* Copyright 2012-2022 the original author or authors.
|
||||||
*
|
*
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
* you may not use this file except in compliance with the License.
|
* you may not use this file except in compliance with the License.
|
||||||
@ -41,34 +41,27 @@ class Saml2RelyingPartyPropertiesTests {
|
|||||||
|
|
||||||
@Test
|
@Test
|
||||||
void customizeSsoUrl() {
|
void customizeSsoUrl() {
|
||||||
bind("spring.security.saml2.relyingparty.registration.simplesamlphp.identity-provider.single-sign-on.url",
|
bind("spring.security.saml2.relyingparty.registration.simplesamlphp.asserting-party.single-sign-on.url",
|
||||||
"https://simplesaml-for-spring-saml/SSOService.php");
|
"https://simplesaml-for-spring-saml/SSOService.php");
|
||||||
assertThat(
|
assertThat(
|
||||||
this.properties.getRegistration().get("simplesamlphp").getIdentityprovider().getSinglesignon().getUrl())
|
this.properties.getRegistration().get("simplesamlphp").getAssertingParty().getSinglesignon().getUrl())
|
||||||
.isEqualTo("https://simplesaml-for-spring-saml/SSOService.php");
|
.isEqualTo("https://simplesaml-for-spring-saml/SSOService.php");
|
||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
void customizeSsoBinding() {
|
void customizeSsoBinding() {
|
||||||
bind("spring.security.saml2.relyingparty.registration.simplesamlphp.identity-provider.single-sign-on.binding",
|
bind("spring.security.saml2.relyingparty.registration.simplesamlphp.asserting-party.single-sign-on.binding",
|
||||||
"post");
|
"post");
|
||||||
assertThat(this.properties.getRegistration().get("simplesamlphp").getIdentityprovider().getSinglesignon()
|
assertThat(this.properties.getRegistration().get("simplesamlphp").getAssertingParty().getSinglesignon()
|
||||||
.getBinding()).isEqualTo(Saml2MessageBinding.POST);
|
.getBinding()).isEqualTo(Saml2MessageBinding.POST);
|
||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
void customizeSsoSignRequests() {
|
void customizeSsoSignRequests() {
|
||||||
bind("spring.security.saml2.relyingparty.registration.simplesamlphp.identity-provider.single-sign-on.sign-request",
|
bind("spring.security.saml2.relyingparty.registration.simplesamlphp.asserting-party.single-sign-on.sign-request",
|
||||||
"false");
|
"false");
|
||||||
assertThat(this.properties.getRegistration().get("simplesamlphp").getIdentityprovider().getSinglesignon()
|
assertThat(this.properties.getRegistration().get("simplesamlphp").getAssertingParty().getSinglesignon()
|
||||||
.isSignRequest()).isEqualTo(false);
|
.getSignRequest()).isEqualTo(false);
|
||||||
}
|
|
||||||
|
|
||||||
@Test
|
|
||||||
void customizeSsoSignRequestsIsTrueByDefault() {
|
|
||||||
this.properties.getRegistration().put("simplesamlphp", new Saml2RelyingPartyProperties.Registration());
|
|
||||||
assertThat(this.properties.getRegistration().get("simplesamlphp").getIdentityprovider().getSinglesignon()
|
|
||||||
.isSignRequest()).isEqualTo(true);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
@ -86,10 +79,10 @@ class Saml2RelyingPartyPropertiesTests {
|
|||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
void customizeIdentityProviderMetadataUri() {
|
void customizeAssertingPartyMetadataUri() {
|
||||||
bind("spring.security.saml2.relyingparty.registration.simplesamlphp.identityprovider.metadata-uri",
|
bind("spring.security.saml2.relyingparty.registration.simplesamlphp.asserting-party.metadata-uri",
|
||||||
"https://idp.example.org/metadata");
|
"https://idp.example.org/metadata");
|
||||||
assertThat(this.properties.getRegistration().get("simplesamlphp").getIdentityprovider().getMetadataUri())
|
assertThat(this.properties.getRegistration().get("simplesamlphp").getAssertingParty().getMetadataUri())
|
||||||
.isEqualTo("https://idp.example.org/metadata");
|
.isEqualTo("https://idp.example.org/metadata");
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -262,7 +262,7 @@ You can register multiple relying parties under the `spring.security.saml2.relyi
|
|||||||
credentials:
|
credentials:
|
||||||
- private-key-location: "path-to-private-key"
|
- private-key-location: "path-to-private-key"
|
||||||
certificate-location: "path-to-certificate"
|
certificate-location: "path-to-certificate"
|
||||||
identityprovider:
|
asserting-party:
|
||||||
verification:
|
verification:
|
||||||
credentials:
|
credentials:
|
||||||
- certificate-location: "path-to-verification-cert"
|
- certificate-location: "path-to-verification-cert"
|
||||||
@ -278,7 +278,7 @@ You can register multiple relying parties under the `spring.security.saml2.relyi
|
|||||||
credentials:
|
credentials:
|
||||||
- private-key-location: "path-to-private-key"
|
- private-key-location: "path-to-private-key"
|
||||||
certificate-location: "path-to-certificate"
|
certificate-location: "path-to-certificate"
|
||||||
identityprovider:
|
asserting-party:
|
||||||
verification:
|
verification:
|
||||||
credentials:
|
credentials:
|
||||||
- certificate-location: "path-to-other-verification-cert"
|
- certificate-location: "path-to-other-verification-cert"
|
||||||
|
@ -8,10 +8,10 @@ spring:
|
|||||||
credentials:
|
credentials:
|
||||||
- private-key-location: "classpath:saml/privatekey.txt"
|
- private-key-location: "classpath:saml/privatekey.txt"
|
||||||
certificate-location: "classpath:saml/certificate.txt"
|
certificate-location: "classpath:saml/certificate.txt"
|
||||||
identityprovider:
|
asserting-party:
|
||||||
verification:
|
verification:
|
||||||
credentials:
|
credentials:
|
||||||
- certificate-location: "classpath:saml/certificate.txt"
|
- certificate-location: "classpath:saml/certificate.txt"
|
||||||
entity-id: simplesaml
|
entity-id: simplesaml
|
||||||
singlesignon:
|
singlesignon:
|
||||||
url: https://simplesaml-for-spring-saml/SSOService.php
|
url: https://simplesaml-for-spring-saml/SSOService.php
|
||||||
@ -21,10 +21,10 @@ spring:
|
|||||||
credentials:
|
credentials:
|
||||||
- private-key-location: "classpath:saml/privatekey.txt"
|
- private-key-location: "classpath:saml/privatekey.txt"
|
||||||
certificate-location: "classpath:saml/certificate.txt"
|
certificate-location: "classpath:saml/certificate.txt"
|
||||||
identityprovider:
|
asserting-party:
|
||||||
verification:
|
verification:
|
||||||
credentials:
|
credentials:
|
||||||
- certificate-location: "classpath:saml/certificate.txt"
|
- certificate-location: "classpath:saml/certificate.txt"
|
||||||
entity-id: okta-id-1234
|
entity-id: okta-id-1234
|
||||||
singlesignon:
|
singlesignon:
|
||||||
url:
|
url:
|
||||||
|
@ -46,7 +46,7 @@ class SampleSaml2RelyingPartyApplicationTests {
|
|||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
void loginShouldHaveAllIdentityProvidersToChooseFrom() {
|
void loginShouldHaveAllAssertingPartiesToChooseFrom() {
|
||||||
ResponseEntity<String> entity = this.restTemplate.getForEntity("/login", String.class);
|
ResponseEntity<String> entity = this.restTemplate.getForEntity("/login", String.class);
|
||||||
assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
|
assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
|
||||||
assertThat(entity.getBody()).contains("/saml2/authenticate/simplesamlphp");
|
assertThat(entity.getBody()).contains("/saml2/authenticate/simplesamlphp");
|
||||||
|
Loading…
Reference in New Issue
Block a user