OpenSAML对接Azure AD遇CORS错误PreflightMissingAllowOriginHeader求解决方案

多日排查仍未解决基于OpenSAML的SSO集成问题：将SAML请求重定向至身份提供商（Azure AD）时出现CORS错误「PreflightMissingAllowOriginHeader」。

认证流程 #

• 用户访问未登录的受保护页面，触发认证流程
• GWT客户端通过RPC调用请求GWT服务端
• 服务提供商（SP）构建SAML认证请求（AuthnRequest）并将其重定向至IdP（Azure AD）
• 本应触发多因素认证（MFA），但实际出现上述CORS错误

我认为该错误在当前场景下是合理的，但不清楚如何在自身环境中修改预检请求头。

系统环境 #

• Java 8
• Eclipse Jetty Webserver 9.4.49
• GWT-Framework 2.8.2
• OpenSAML 3.2.0
• Azure AD作为IdP

预检响应头 #

Cache-Control: no-store, no-cache
Content-Encoding: gzip
Content-Length: 40803
Content-Type: text/html; charset=utf-8
Date: Wed, 05 Apr 2023 07:07:32 GMT
Expires: -1
Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin
Link: <https://aadcdn.msauth.net>; rel=dns-prefetch
Link: <https://aadcdn.msftauth.net>; rel=dns-prefetch
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=<<CAT_ID>>"}]}
Set-Cookie: fpc=AjRI9MA0hDRJhucHRbH9GwE; expires=Fri, 05-May-2023 07:07:32 GMT; path=/; secure; HttpOnly; SameSite=None
Set-Cookie: esctx=<<COOKIE>>; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None
Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly
Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: on
x-ms-ests-server: 2.1.14939.4 - WEULR2 ProdSlices
x-ms-request-id: <<REQUEST_ID>>
X-XSS-Protection: 0

已尝试的方案 #

• 在HTTPRedirectDeflateEncoder的HttpServletResponse对象中手动设置请求头
• 为org.eclipse.equinox.http.servlet.ExtendedHttpService添加过滤器，向HttpServletResponse中添加请求头
• 自定义Jetty的CorsHandler，继承org.eclipse.jetty.server.handler.AbstractHandler

内容的提问来源于stack exchange，提问作者nDo94