Spring SAML Security - Multiple IDP Metadata configuration for two different ADFS server

Question

Is that possible to have multiple IDP Metadata configuration? How do I configure it? In my environment I have two different ADFS servers and both has its own Metadata.xml files.

In the securityContext.xml file I have following configuration for my ADFS server IDP selection:

<bean id="metadata"
class="org.springframework.security.saml.metadata.CachingMetadataManager">
<constructor-arg>
<list>
<bean class="org.opensaml.saml2.metadata.provider.HTTPMetadataProvider">
<constructor-arg>
<value type="java.lang.String">https://<adfs_server1>/FederationMetadata/2007-06/FederationMetadata.xml</value>
</constructor-arg>
<constructor-arg>
<value type="int">50000</value>
</constructor-arg>
<property name="parserPool" ref="parserPool" />
</bean>
</list>
</constructor-arg>
</bean>

is it possible to add another entry same as above for two different ADFS servers like:

<bean id="metadata"
class="org.springframework.security.saml.metadata.CachingMetadataManager">
<constructor-arg>
<list>
<bean class="org.opensaml.saml2.metadata.provider.HTTPMetadataProvider">
<constructor-arg>
<value type="java.lang.String">https://<adfs_server1>/FederationMetadata/2007-06/FederationMetadata.xml</value>
</constructor-arg>
<constructor-arg>
<value type="int">50000</value>
</constructor-arg>
<property name="parserPool" ref="parserPool" />
</bean>
</list>
</constructor-arg>
</bean>
<bean id="metadata1"
class="org.springframework.security.saml.metadata.CachingMetadataManager">
<constructor-arg>
<list>
<bean class="org.opensaml.saml2.metadata.provider.HTTPMetadataProvider">
<constructor-arg>
<value type="java.lang.String">https://<adfs_server2>/FederationMetadata/2007-06/FederationMetadata.xml</value>
</constructor-arg>
<constructor-arg>
<value type="int">50000</value>
</constructor-arg>
<property name="parserPool" ref="parserPool" />
</bean>
</list>
</constructor-arg>
</bean>

Please help.

Can there be two different URLs? For example using a proxy for external users. External URL points to IDP A and Internal URL points to IDP B. — Dot Batch
@theLearner yes, I had to write a lot of custom code to make it work. But yes. — Dot Batch

Vladimír Schäfer Vladimír Schäfer · Accepted Answer · 2014-09-23T12:35:53

Yes, you can include as many IDPs as you want. But not by adding multiple CachingMetadataManager beans, you should instead include multiple MetadataProviders inside a single MetadataManager. The configuration could look like this:

<bean id="metadata" class="org.springframework.security.saml.metadata.CachingMetadataManager">
    <constructor-arg>
        <list>
            <bean class="org.opensaml.saml2.metadata.provider.HTTPMetadataProvider">
                <constructor-arg>
                    <value type="java.lang.String">https://<adfs_server1>/FederationMetadata/2007-06/FederationMetadata.xml</value>
                </constructor-arg>
                <constructor-arg>
                    <value type="int">50000</value>
                </constructor-arg>
                <property name="parserPool" ref="parserPool"/>
            </bean>
            <bean class="org.opensaml.saml2.metadata.provider.HTTPMetadataProvider">
                <constructor-arg>
                    <value type="java.lang.String">https://<adfs_server2>/FederationMetadata/2007-06/FederationMetadata.xml</value>
                </constructor-arg>
                <constructor-arg>
                    <value type="int">50000</value>
                </constructor-arg>
                <property name="parserPool" ref="parserPool"/>
            </bean>
        </list>
    </constructor-arg>
</bean>

You will need to provide a mechanism which determines which of the IDPs should be used when user wants to authenticate. You can do so either by specifying GET parameter idp with value of the entityId of the selected IDP when invoking the /saml/login endpoint, or by implementing IDP discovery.

Spring SAML Security - Multiple IDP Metadata configuration for two different ADFS server

1 Answers