Spring Boot 3集成SAML2认证：SAMLProcessingFilter配置AuthenticationManager问题

问题背景 #

想用Spring Boot 3和Java 17开发集成SAML2令牌认证的应用，由于Spring Security 5.7+（对应Spring Boot 3）不再支持继承WebSecurityConfigurerAdapter，不知道如何给SAMLProcessingFilter提供AuthenticationManager用于FilterChainProxy，核心疑问是samlWebSSOProcessingFilter.setAuthenticationManager(???);该填什么。

修正后的完整配置代码 #

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {

    @Value("${saml.sp}")
    private String samlAudience;

    @Autowired
    @Qualifier("saml")
    private SavedRequestAwareAuthenticationSuccessHandler samlAuthSuccessHandler;

    @Autowired
    @Qualifier("saml")
    private SimpleUrlAuthenticationFailureHandler samlAuthFailureHandler;

    @Autowired
    private SAMLEntryPoint samlEntryPoint;

    @Autowired
    private SAMLLogoutFilter samlLogoutFilter;

    @Autowired
    private SAMLLogoutProcessingFilter samlLogoutProcessingFilter;

    @Autowired
    private SAMLAuthenticationProvider samlAuthenticationProvider;

    @Autowired
    private ExtendedMetadata extendedMetadata;

    @Autowired
    private KeyManager keyManager;

    // 生成SAML服务提供商元数据
    @Bean
    public MetadataGenerator metadataGenerator() {
        MetadataGenerator metadataGenerator = new MetadataGenerator();
        metadataGenerator.setEntityId(samlAudience);
        metadataGenerator.setExtendedMetadata(extendedMetadata);
        metadataGenerator.setIncludeDiscoveryExtension(false);
        metadataGenerator.setKeyManager(keyManager);
        return metadataGenerator;
    }

    // 配置SAML单点登录处理过滤器
    @Bean
    public SAMLProcessingFilter samlWebSSOProcessingFilter(AuthenticationManager authenticationManager) throws Exception {
        SAMLProcessingFilter samlWebSSOProcessingFilter = new SAMLProcessingFilter();
        // 直接注入配置好的AuthenticationManager
        samlWebSSOProcessingFilter.setAuthenticationManager(authenticationManager);
        samlWebSSOProcessingFilter.setAuthenticationSuccessHandler(samlAuthSuccessHandler);
        samlWebSSOProcessingFilter.setAuthenticationFailureHandler(samlAuthFailureHandler);
        return samlWebSSOProcessingFilter;
    }

    // 构建SAML专属过滤器链
    @Bean
    public FilterChainProxy samlFilter(SAMLProcessingFilter samlWebSSOProcessingFilter, SAMLDiscovery samlDiscovery) throws Exception {
        List<SecurityFilterChain> chains = new ArrayList<>();
        chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/SSO/**"),
                samlWebSSOProcessingFilter));
        chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/discovery/**"),
                samlDiscovery));
        chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/login/**"),
                samlEntryPoint));
        chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/logout/**"),
                samlLogoutFilter));
        chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/SingleLogout/**"),
                samlLogoutProcessingFilter));
        return new FilterChainProxy(chains);
    }

    // 配置AuthenticationManager，注册SAML认证提供者
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
        AuthenticationManagerBuilder authBuilder = authConfig.getAuthenticationManagerBuilder();
        authBuilder.authenticationProvider(samlAuthenticationProvider);
        return authBuilder.build();
    }

    @Bean
    public MetadataGeneratorFilter metadataGeneratorFilter() {
        return new MetadataGeneratorFilter(metadataGenerator());
    }

    // 全局安全规则配置，替代原WebSecurityConfigurerAdapter的configure方法
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http, FilterChainProxy samlFilter) throws Exception {
        http
                .csrf(csrf -> csrf.disable())
                .httpBasic(basic -> basic.authenticationEntryPoint(samlEntryPoint))
                .authorizeHttpRequests(auth -> auth
                        .requestMatchers("/").permitAll()
                        .anyRequest().authenticated())
                .logout(logout -> logout
                        .addLogoutHandler((request, response, authentication) -> {
                            try {
                                response.sendRedirect("/saml/logout");
                            } catch (IOException e) {
                                e.printStackTrace();
                            }
                        }));

        // 挂载SAML相关过滤器到全局链中
        http.addFilterBefore(metadataGeneratorFilter(), ChannelProcessingFilter.class)
                .addFilterAfter(samlFilter, BasicAuthenticationFilter.class)
                .addFilterBefore(samlFilter, CsrfFilter.class);

        return http.build();
    }

    @Bean
    public SAMLDiscovery samlDiscovery() {
        return new SAMLDiscovery();
    }
}

关键修改说明 #

1. 直接注入AuthenticationManager：把samlWebSSOProcessingFilter方法的参数改为AuthenticationManager，Spring会自动注入我们配置好的实例，避免手动调用方法引发的循环依赖问题。
2. 正确配置AuthenticationManager：在authenticationManager方法中，通过AuthenticationConfiguration获取构建器，注册SAMLAuthenticationProvider，确保SAML认证请求能被正确处理。
3. 替换废弃的配置方式：移除原configure(HttpSecurity)方法，改用@Bean SecurityFilterChain的形式配置全局安全规则，这是Spring Security 5.7+官方推荐的配置方案。
4. 优化过滤器依赖：samlFilter方法直接注入所需过滤器Bean，避免重复创建实例，提升配置稳定性。

内容的提问来源于stack exchange，提问作者VISHAL ANAND