Spring Security SAML2 SP 6.1.3中KeyManager与JKSKeyManager替代方案咨询

在Spring Security SAML2 6.x版本中，原KeyManager和JKSKeyManager的密钥管理功能被拆分到更轻量化的组件中，无需直接实例化类似类，而是通过声明式配置或核心类实现相同能力。

1. 核心替代组件 #

• Saml2X509Credential：6.x中表示SAML2密钥/证书的核心载体，替代旧版本KeyManager管理的密钥条目，支持签名、加密、验证、解密四种密钥类型。
• Saml2X509Credential.Builder：用于快速构建Saml2X509Credential实例，可指定私钥、证书链、密钥类型等参数。

2. 手动加载JKS密钥库实现 #

直接通过Java标准KeyStore类加载JKS文件，再转换为Saml2X509Credential：

@Bean
public List<Saml2X509Credential> saml2Credentials() throws Exception {
    // 加载JKS密钥库
    KeyStore keyStore = KeyStore.getInstance("JKS");
    try (InputStream is = new ClassPathResource("saml-keystore.jks").getInputStream()) {
        keyStore.load(is, "keystore-password".toCharArray());
    }

    // 提取签名/加密用的私钥与证书链
    PrivateKey privateKey = (PrivateKey) keyStore.getKey("private-key-alias", "key-password".toCharArray());
    X509Certificate cert = (X509Certificate) keyStore.getCertificateChain("private-key-alias")[0];
    Saml2X509Credential signingEncCredential = Saml2X509Credential.builder()
            .privateKey(privateKey)
            .certificate(cert)
            .type(Saml2X509Credential.Type.SIGNING)
            .type(Saml2X509Credential.Type.ENCRYPTION)
            .build();

    // 提取IDP签名验证用证书
    X509Certificate idpCert = (X509Certificate) keyStore.getCertificate("idp-cert-alias");
    Saml2X509Credential verificationCredential = Saml2X509Credential.builder()
            .certificate(idpCert)
            .type(Saml2X509Credential.Type.VERIFICATION)
            .build();

    return Arrays.asList(signingEncCredential, verificationCredential);
}

3. 集成到服务提供者配置 #

将上述Credential列表注入SAML2服务提供者配置中，替代原KeyManager的作用：

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
        .saml2Login(saml2 -> saml2
            .serviceProviderRegistration(reg -> reg
                .registrationId("your-sp-id")
                .entityId("https://your-sp.com/saml/metadata")
                .assertionConsumerServiceLocation("https://your-sp.com/login/saml2/sso/your-sp-id")
                .signingCredentials(c -> c.addAll(saml2Credentials()))
                .decryptionCredentials(c -> c.addAll(saml2Credentials()))
                .idpEntityId("https://your-idp.com/idp")
                .webSsoUrl("https://your-idp.com/idp/SSOService.saml2")
                .verificationCredentials(c -> c.addAll(saml2Credentials()))
            )
        )
        .saml2Logout(saml2 -> saml2
            .logoutRequest(req -> req.signingCredentials(saml2Credentials()))
        );
    return http.build();
}

4. 旧功能映射 #

• 原KeyManager.getDefaultCredential()：从Saml2X509Credential列表中筛选标记为SIGNING或ENCRYPTION的条目即可。
• 原KeyManager.getCredential(String alias)：直接通过KeyStore按别名提取密钥/证书，再构建对应的Saml2X509Credential。
• 原KeyManager.getAvailableCredentials()：即手动构建的Saml2X509Credential列表。

5. Spring Boot自动配置简化（可选） #

如果使用Spring Boot，可直接通过配置文件声明密钥库信息，无需手动加载：

spring:
  security:
    saml2:
      relyingparty:
        registration:
          your-sp-id:
            entity-id: "https://your-sp.com/saml/metadata"
            assertion-consumer-service:
              location: "https://your-sp.com/login/saml2/sso/your-sp-id"
            signing:
              credentials:
                - keystore-location: "classpath:saml-keystore.jks"
                  keystore-password: "keystore-password"
                  key-alias: "private-key-alias"
                  key-password: "key-password"
            decryption:
              credentials:
                - keystore-location: "classpath:saml-keystore.jks"
                  keystore-password: "keystore-password"
                  key-alias: "private-key-alias"
                  key-password: "key-password"
            idp:
              entity-id: "https://your-idp.com/idp"
              single-sign-on-service:
                location: "https://your-idp.com/idp/SSOService.saml2"
              verification:
                credentials:
                  - certificate-location: "classpath:idp-cert.pem"

内容的提问来源于stack exchange，提问作者Sid