From 58ba38449b4f4608ec304854543f76608d8216ed Mon Sep 17 00:00:00 2001 From: Josh Cummings Date: Thu, 7 Nov 2024 12:45:29 -0700 Subject: [PATCH] Update READMEs - Stated Docker dependencies - Updated u/p information --- .../spring-boot/java/saml2/login/README.adoc | 64 ++++++++------ .../saml2/refreshable-metadata/README.adoc | 53 +++++++----- .../saml-extension-federation/README.adoc | 85 +++++++++---------- 3 files changed, 113 insertions(+), 89 deletions(-) diff --git a/servlet/spring-boot/java/saml2/login/README.adoc b/servlet/spring-boot/java/saml2/login/README.adoc index e685731..e7d11b0 100644 --- a/servlet/spring-boot/java/saml2/login/README.adoc +++ b/servlet/spring-boot/java/saml2/login/README.adoc @@ -8,6 +8,45 @@ module which is new in Spring Security 5.2. The https://docs.spring.io/spring-security/reference/servlet/saml2/logout.html[SAML 2.0 Logout feature] is new in Spring Security 5.6. +== Run the Sample + +=== Install Docker + +This sample requires Docker to run a local IdP. +As an alternative, you can point the sample at your own IdP by changing the `application.yml` here: + +[source,java] +---- +spring: + security: + saml2: + relyingparty: + registration: + one: + assertingparty.metadata-uri: {your-idp-metadata-endpoint} +// ... + two: + assertingparty.metadata-uri: {your-idp-metadata-endpoint} +---- + +=== Start up the Sample Boot Application +``` + ./gradlew :servlet:spring-boot:java:saml2:login:bootRun +``` + +=== Open a Browser + +http://localhost:8080/ + +You will be redirected to the SimpleSAMLPHP instance. + +=== Type in your credentials + +``` +User: user1 +Password: user1pass +``` + == Goals === SAML 2.0 Login @@ -29,28 +68,3 @@ On this sample, the SAML 2.0 Logout is using the HTTP-POST binding. You can refer to the https://docs.spring.io/spring-security/reference/servlet/saml2/logout.html[reference documentation] for more details about the RP- and AP-initiated SAML 2.0 Logout. -== Run the Sample - -=== Prerequisites - -This sample requires Docker in order to stand up the identity provider. -If you don't have Docker, you can alternatively disable Docker in `application.yml` and stand up your own IdP. - -=== Start up the Sample Boot Application -``` - ./gradlew :servlet:spring-boot:java:saml2:login:bootRun -``` - -=== Open a Browser - -http://localhost:8080/ - -You will be redirected to a chooser page where you can pick between one of two identity providers. - -=== Type in your credentials - -``` -User: user1 -Password: user1pass -``` - diff --git a/servlet/spring-boot/java/saml2/refreshable-metadata/README.adoc b/servlet/spring-boot/java/saml2/refreshable-metadata/README.adoc index c98a153..218dd12 100644 --- a/servlet/spring-boot/java/saml2/refreshable-metadata/README.adoc +++ b/servlet/spring-boot/java/saml2/refreshable-metadata/README.adoc @@ -8,6 +8,37 @@ module which is new in Spring Security 5.2. The https://docs.spring.io/spring-security/reference/servlet/saml2/logout.html[SAML 2.0 Logout feature] is new in Spring Security 5.6. +== Run the Sample + +=== Install Docker + +This sample requires Docker to run a local IdP. +As an alternative, you can point the sample at your own IdP by changing the `application.yml` here: + +[source,java] +---- +saml2: + ap.metadata: {your-idp-metadata-endpoint} +---- + +=== Start up the Sample Boot Application +``` + ./gradlew :servlet:spring-boot:java:saml2:refreshable-metadata:bootRun +``` + +=== Open a Browser + +http://localhost:8080/ + +You will be redirected to the SimpleSAMLPHP instance. + +=== Type in your credentials + +``` +User: user1 +Password: user1pass +``` + == Goals === SAML 2.0 Login @@ -32,27 +63,7 @@ You can refer to the https://docs.spring.io/spring-security/reference/servlet/sa === Refreshable Asserting Party Metadata The application uses a custom implementation of `RelyingPartyRegistrationRepository` to achieve Asserting Party Metadata refresh feature. -This particular implementation uses a `@Scheduled` annotation to update its metadata every 30 minutes. - -== Run the Sample - -=== Start up the Sample Boot Application -``` - ./gradlew :servlet:spring-boot:java:saml2:refreshable-metadata:bootRun -``` - -=== Open a Browser - -http://localhost:8080/ - -You will be redirect to the Okta SAML 2.0 IDP - -=== Type in your credentials - -``` -User: testuser2@spring.security.saml -Password: 12345678 -``` +This particular implementation relies on an OpenSAML component that refreshes the metadata. diff --git a/servlet/spring-boot/java/saml2/saml-extension-federation/README.adoc b/servlet/spring-boot/java/saml2/saml-extension-federation/README.adoc index 6db51c6..a2fbec5 100644 --- a/servlet/spring-boot/java/saml2/saml-extension-federation/README.adoc +++ b/servlet/spring-boot/java/saml2/saml-extension-federation/README.adoc @@ -7,6 +7,45 @@ This code uses `RelyingPartyRegistrations#collectionFromMetadata` to demonstrate See the https://github.com/spring-projects/spring-security/wiki/SAML-2.0-Migration-Guide[SAML 2.0 Migration Guide] for more details about the migration. +== Run the Sample + +=== Install Docker + +This sample requires Docker to run a local IdP. +As an alternative, you can point the sample at your own IdP by changing the `application.yml` here: + +[source,java] +---- +spring: + security: + saml2: + relyingparty: + registration: + one: + assertingparty.metadata-uri: {your-idp-metadata-endpoint} +// ... + two: + assertingparty.metadata-uri: {your-idp-metadata-endpoint} +---- + +=== Start up the Sample Boot Application +``` + ./gradlew :servlet:spring-boot:java:saml2:saml-extension-federation:bootRun +``` + +=== Open a Browser + +http://localhost:8080/ + +You will be redirected to the SimpleSAMLPHP instance. + +=== Type in your credentials + +``` +User: user1 +Password: user1pass +``` + == Key Changes === URL Forwarding Filter @@ -51,48 +90,8 @@ public class SamlExtensionUrlForwardingFilter extends OncePerRequestFilter { } ---- -=== application.yml +=== `RelyingPartyMetadata` configuration component -[source%linenums,yml] ----- -spring: - security: - filter: - dispatcher-types: async, error, request, forward <1> - saml2: - relyingparty: - registration: - one: - singlelogout: - binding: POST - url: "{baseUrl}/saml/logout" <2> - responseUrl: "{baseUrl}/saml/SingleLogout" <3> - acs: - location: "{baseUrl}/saml/SSO" <4> - assertingparty.metadata-uri: https://dev-05937739.okta.com/app/exk598vc9bHhwoTXM5d7/sso/saml/metadata ----- +The `RelyingPartyRegistration` properties are customized to match the values that were used by the SAML Extension. -==== `RelyingPartyRegistration` properties - -The `RelyingPartyRegistration` properties should also be customized to match the values that were used by the SAML Extension (see <2>, <3> and <4> above). - -== Run the Sample - -=== Start up the Sample Boot Application -``` - ./gradlew :servlet:spring-boot:java:saml2:saml-extension-federation:bootRun -``` - -=== Open a Browser - -http://localhost:8080/ - -Select the first IdP listed. -You will be redirect to the Okta SAML 2.0 IDP - -=== Type in your credentials - -``` -User: testuser2@spring.security.saml -Password: 12345678 -``` +These reside in `RelyingPartyMetadata`.