Spring Security SAML2 v6.4.1如何在元数据生成指定签名属性

问题 #

我开发的应用需集成不受控的现有SSO。此前使用Spring Boot 2.1.2.RELEASE及spring-security-saml2-core 1.0.10.RELEASE等依赖，生成的依赖方元数据中<md:SPSSODescriptor>包含AuthnRequestsSigned="true"和WantAssertionsSigned="true"属性。现升级至Spring Boot 3.4.0-M3、Spring Security SAML2 v6.4.0-M4等版本，按官方文档配置SecurityConfig及application.yml后，元数据中上述属性消失，请问如何配置才能重新生成这两个属性？

此前依赖配置 #

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>2.1.2.RELEASE</version>
    <relativePath/> <!-- lookup parent from repository -->
</parent>

<dependency>
    <groupId>org.springframework.security.extensions</groupId>
    <artifactId>spring-security-saml2-core</artifactId>
    <version>1.0.10.RELEASE</version>
</dependency>
<dependency>
    <groupId>org.springframework.security.extensions</groupId>
    <artifactId>spring-security-saml-dsl-core</artifactId>
    <version>1.0.5.RELEASE</version>
</dependency>

升级后版本 #

<spring-boot.version> 3.4.0-M3
<spring-security-saml2-core.version> 2.0.0.M31
<spring-security-saml-dsl-core.version> 1.0.5.RELEASE
<spring-security-saml2-service-provider.version> 6.4.0-M4

当前SecurityConfig #

@Configuration
@EnableWebSecurity
@EnableMethodSecurity(securedEnabled = true)
public class SecurityConfig{
    private static final String SAML_METADATA = "/saml/metadata";

    @Autowired
    PmaLdapValidationHandler pmaLdapValidationHandler;

    @Bean
    SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {

        // @formatter:off
        http
            .saml2Metadata((saml2) -> saml2.metadataUrl(SAML_METADATA))
            .saml2Login(withDefaults()).saml2Logout(withDefaults())
            .logout(withDefaults())
            .authorizeHttpRequests((authorize) -> authorize.anyRequest().authenticated());
        // @formatter:on
        return http.build();
    }
}

当前application.yml #

logging.level.org.springframework.security: DEBUG
logging.level.org.springframework.security.saml2: DEBUG

spring:
  mvc:
    view:
      prefix: /templates/
      suffix: .pug
    static-path-pattern: /static/**

  security:
    saml2:
      relyingparty:
        registration:
          pma_web:
            entity-id: "${sso.entity-id}"
            signing:
              credentials:
                - private-key-location: classpath:saml/credentials/rp-private.key
                  certificate-location: classpath:saml/credentials/rp-certificate.crt
            singlelogout:
              binding: POST
              url: "{baseUrl}/logout/saml2/slo"
            assertingparty:
              metadata-uri: classpath:saml/${env}/metadata.xml

  datasource:
    jndi-name: java:jboss/datasources/pma_web
  jpa:
    hibernate:
      ddl-auto: update
    properties:
      hibernate:
        dialect: org.hibernate.dialect.PostgreSQLDialect

pma-cmdb:
  pma-keystore-key-alias: pma-jwt-signing-key
  pma-keystore-password: pma-jwt-p422w0rd

解决方案 #

要在Spring Security 6.x的SAML2元数据中恢复AuthnRequestsSigned="true"和WantAssertionsSigned="true"属性，需完成以下配置：

1. 启用认证请求签名（对应AuthnRequestsSigned="true"） #

在application.yml的SAML2依赖方配置中，添加开启认证请求签名的配置项：

spring:
  security:
    saml2:
      relyingparty:
        registration:
          pma_web:
            # 保留原有配置
            authentication-requests-signing-enabled: true

也可通过Java代码配置实现：

http.saml2Login(saml2 -> saml2
        .authenticationRequestResolver(resolver -> 
                resolver.setSignRequest(true)));

2. 要求断言签名（对应WantAssertionsSigned="true"） #

在断言方配置中添加要求断言必须签名的配置：

spring:
  security:
    saml2:
      relyingparty:
        registration:
          pma_web:
            # 保留原有配置
            assertingparty:
              # 保留原有配置
              want-assertions-signed: true

Java代码配置方式：

http.saml2Login(saml2 -> saml2
        .metadata(metadata -> metadata
                .assertingPartyDetails(details -> 
                        details.wantAssertionsSigned(true))));

3. 验证配置效果 #

完成配置后，访问元数据端点/saml/metadata，检查<md:SPSSODescriptor>标签是否已包含目标属性。注意：需确保签名凭证（私钥和证书）已正确配置，此为签名功能生效的前提，现有配置中已包含该部分内容，无需额外修改。

内容的提问来源于stack exchange，提问作者Francisco M