Spring Security SAML with standard java application

1
votes

We have a requirement where we need to enable SAML authentication in our application for a customer that has ADFS as IDP.

After considering various options, I was able to get this working with Spring SAML security as provided in the documents. Now the issue is to integrate the SAML security with our application.

Unfortunately, our application is still a leagacy java application using servlets and jsp and not spring based. I was just wondering how can the 2 be integrated. The document mentions that this possible .However, i was unable to find any write up on it.

Can someone plz direct me to the relevant source that can provide guidelines for this approach.

Thanks.

2
javaspring-securityadfsspring-saml

2 Answers

2
votes

Classes in package org.springframework.security.saml.websso contain the core of SAML processing functionality and are independent of Spring Security. They do contain few class imports from Spring, therefore Spring-core classes need need to be on the classpath, but the application itself doesn't need to use Spring/SpringSecurity.

You will need to re-implement yourself logic which is specific to Spring Security - package org.springframework.security.saml - e.g. SAMLEntryPoint, SAMLProcessingFilter, and call your implementation during your authentication lifecycle. Logic of these classes is simple, so enabling basic use-cases is pretty easy.

0
votes

Thanks Vladimír for the guidance. This is how i integrated a standard legacy java app with spring security for saml based authentication:

  1. Modified securityContext.xml
    set idpDiscoveryEnabled=false
    set forceAuthN= true to force user to login when saml token expires
    updated defaulttargetURL in successHandler to authhandler.jsp page,present in spring security app, to redirect back to my application
  2. I have a filter applied on all the web calls in my java app . This filter redirects the call to /spring-security-saml2/saml/login
  3. spring saml authenticates the user with ADFS.On successful authentication, user is redirected to authhandler.jsp
  4. Authhandler.jsp is same as index.jsp but the retrieved claims are hidden fields here. These values in hidden fields are send back to my standarda java application.
  5. Here my java application performs other application level authentication and proceeds as desired.

Would appreciate any suggestions for improvisation or identification of any flaws in the above approach