Spring Security SAML2多身份提供商共用静态loginProcessingUrl咨询

可行性结论 #

完全可以实现，核心思路是在发起SAML认证请求时将registrationId嵌入请求字段（比如RelayState），让IDP在返回SAML响应时带回该标识，最后通过自定义转换器从响应中提取registrationId，匹配对应的RelyingPartyRegistration。

具体实现步骤 #

1. 自定义SAML认证请求的RelayState生成逻辑 #

Spring Security的OpenSamlAuthenticationRequestResolver负责生成SAML认证请求，我们可以扩展它，将registrationId存入RelayState（IDP会原样返回该字段）：

@Component
public class CustomOpenSamlAuthenticationRequestResolver extends OpenSamlAuthenticationRequestResolver {
    public CustomOpenSamlAuthenticationRequestResolver(RelyingPartyRegistrationRepository registrations) {
        super(registrations);
    }

    @Override
    protected Saml2AuthenticationRequest createSaml2AuthenticationRequest(
            RelyingPartyRegistration registration, HttpServletRequest request) {
        Saml2AuthenticationRequest authRequest = super.createSaml2AuthenticationRequest(registration, request);
        // 将registrationId写入RelayState，IDP返回响应时会带回
        return Saml2AuthenticationRequest.withAuthenticationRequest(authRequest)
                .relayState(registration.getRegistrationId())
                .build();
    }
}

2. 自定义Saml2AuthenticationTokenConverter，从响应中提取registrationId #

默认的Saml2AuthenticationTokenConverter从请求URI的{registrationId}变量取值，我们需要重写逻辑，改为从SAML响应的RelayState中获取标识，再匹配对应的注册信息：

public class CustomSaml2AuthenticationTokenConverter extends Saml2AuthenticationTokenConverter {
    private final RelyingPartyRegistrationRepository registrationRepository;

    public CustomSaml2AuthenticationTokenConverter(RelyingPartyRegistrationRepository registrationRepository) {
        this.registrationRepository = registrationRepository;
    }

    @Override
    protected RelyingPartyRegistration resolveRelyingPartyRegistration(HttpServletRequest request) {
        // 从请求参数中获取IDP带回的RelayState
        String relayState = request.getParameter("RelayState");
        if (relayState == null) {
            throw new Saml2AuthenticationException("RelayState not found in SAML response");
        }
        // 根据RelayState中的registrationId查找对应的注册配置
        return this.registrationRepository.findByRegistrationId(relayState)
                .orElseThrow(() -> new Saml2AuthenticationException("No relying party registration found for id: " + relayState));
    }
}

3. 配置HttpSecurity，启用静态登录处理URL和自定义组件 #

在Spring Security配置类中，设置静态的loginProcessingUrl，替换默认的请求解析器和转换器：

@Configuration
public class SecurityConfig {
    private final CustomOpenSamlAuthenticationRequestResolver customAuthRequestResolver;
    private final RelyingPartyRegistrationRepository registrationRepository;

    public SecurityConfig(RelyingPartyRegistrationRepository registrationRepository) {
        this.registrationRepository = registrationRepository;
        this.customAuthRequestResolver = new CustomOpenSamlAuthenticationRequestResolver(registrationRepository);
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
                .saml2Login(saml2 -> saml2
                        .loginProcessingUrl("/saml2/sso") // 静态URL，无需携带registrationId
                        .authenticationRequestResolver(customAuthRequestResolver)
                        .authenticationTokenConverter(new CustomSaml2AuthenticationTokenConverter(registrationRepository))
                );
        return http.build();
    }
}

关键注意事项 #

• RelayState安全性：如果担心标识被篡改，可以对RelayState内容进行签名或加密，解析时验证有效性，避免恶意构造的registrationId导致错误匹配。
• IDP兼容性：确保你的身份提供商支持返回RelayState字段，绝大多数标准SAML IDP都兼容该特性。
• 与AWS Cognito逻辑对齐：这种实现和Cognito的providerName机制本质一致——都是在认证请求中传递身份提供商标识，IDP返回时带回，再用该标识匹配对应配置。

内容的提问来源于stack exchange，提问作者pulse00