Using SAML with Spring Boot behind an ELB redirects to http instead of https

Question

I'm trying to use Okta to authenticate users from a SpringBoot application.

I've setup the app following the Okta Tutorial from : https://developer.okta.com/blog/2017/03/16/spring-boot-saml

However my app is behind an ELB, and as such the TLS is being terminated at the LB. So I've modified the configuration from the tutorial to suit my needs.

 @Override
protected void configure(final HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
            .antMatchers("/saml*").permitAll()
            .anyRequest().authenticated()
            .and()
        .apply(saml())
            .serviceProvider()
                .keyStore()
                    .storeFilePath(this.keyStoreFilePath)
                    .password(this.password)
                    .keyname(this.keyAlias)
                    .keyPassword(this.password)
                    .and()
                .protocol("https")
                .hostname(String.format("%s", serverName))
                .basePath("/")
                .and()
            .identityProvider()
            .metadataFilePath(this.metadataUrl);
}

This does the trick but there is a problem. After the user is authenticated by Okta, the user is finally redirected to a http URL instead of a https URL. I am thinking the reason for this is that the TLS is being terminated at the LB and my app is actually receiving the request with http which is being sent in the RelayState.

This is something I found : spring-boot-security-saml-config-options.md. It contains a list of SAML properties for spring boot security. I added the following to the application.properties file

saml.sso.context-provider.lb.enabled = true
saml.sso.context-provider.lb.scheme=https
saml.sso.profile-options.relay-state=<https://my.website.com>

It doesn't change the http redirection. Is there something I am doing wrong?

Anders Revsgaard Anders Revsgaard · Accepted Answer · 2018-11-22T10:00:19

When a SAML 2.0 IdP like Okta redirects back to you application the endpoint url is either based on the SAML 2.0 metadata you application expose or the configuration in the IdP.

Furthermore, it is optional to add a Destination property in SAML 2.0 AuthnRequest:

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified" 
    Destination="https://my.website.com" IssueInstant="2018-11-22T09:23:08.844Z" Version="2.0" ID="id-f8ee3ab1-6745-42d5-b00f-7845b97fe953">
<Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion"> ... </Issuer>
...
</samlp:AuthnRequest>

Using SAML with Spring Boot behind an ELB redirects to http instead of https

1 Answers