在Spring Security(Spring Boot)中动态创建SAML注册仓库

可以实现动态添加SAML提供商，但不能直接在应用启动后替换RelyingPartyRegistrationRepository的Bean实例——因为Spring Security初始化时已绑定该Bean，后续替换不会被自动识别。正确的做法是自定义一个支持动态更新的RelyingPartyRegistrationRepository实现，让Spring Security一直使用这个Bean，同时通过接口动态修改其内部的注册信息。

实现步骤 #

1. 自定义动态RelyingPartyRegistrationRepository
   用线程安全的容器存储注册信息，并提供添加/删除方法：

@Component
public class DynamicRelyingPartyRegistrationRepository implements RelyingPartyRegistrationRepository {
    private final ConcurrentHashMap<String, RelyingPartyRegistration> registrations = new ConcurrentHashMap<>();

    // 初始化默认注册（原Okta、Azure配置）
    public DynamicRelyingPartyRegistrationRepository() throws Exception {
        RelyingPartyRegistration oktaRegistration = RelyingPartyRegistrations.fromMetadataLocation("https://trial-27.okta.com/app/e/sso/saml/metadata")
                .registrationId("okta")
                .build();
        RelyingPartyRegistration azureRegistration = RelyingPartyRegistrations.fromMetadataLocation("file:D:\\saml-test-5.xml")
                .registrationId("azure-saml-test")
                .build();
        registrations.put(oktaRegistration.getRegistrationId(), oktaRegistration);
        registrations.put(azureRegistration.getRegistrationId(), azureRegistration);
    }

    @Override
    public RelyingPartyRegistration findByRegistrationId(String registrationId) {
        return registrations.get(registrationId);
    }

    // 动态添加新注册
    public void addRegistration(RelyingPartyRegistration registration) {
        registrations.put(registration.getRegistrationId(), registration);
    }

    // 可选：删除注册
    public void removeRegistration(String registrationId) {
        registrations.remove(registrationId);
    }
}

2. 配置SecurityFilterChain时注入动态Repository
   确保Spring Security和Saml2MetadataFilter都使用同一个动态Repository实例：

@Bean
public SecurityFilterChain filterChain(HttpSecurity http, DynamicRelyingPartyRegistrationRepository dynamicRepo) throws Exception {
    http
            .authorizeRequests(authorize ->
                    authorize.antMatchers("/", "/upload-metadata").permitAll()
                            .anyRequest().authenticated()
            )
            .saml2Login();

    RelyingPartyRegistrationResolver resolver = new DefaultRelyingPartyRegistrationResolver(dynamicRepo);
    Saml2MetadataFilter metadataFilter = new Saml2MetadataFilter(resolver, new OpenSamlMetadataResolver());
    http.addFilterBefore(metadataFilter, Saml2WebSsoAuthenticationFilter.class);
    return http.build();
}

3. 编写元数据上传接口
   接收用户上传的元数据文件，解析后添加到动态Repository：

@RestController
public class SamlMetadataController {
    private final DynamicRelyingPartyRegistrationRepository dynamicRepo;

    public SamlMetadataController(DynamicRelyingPartyRegistrationRepository dynamicRepo) {
        this.dynamicRepo = dynamicRepo;
    }

    @PostMapping("/upload-metadata")
    public ResponseEntity<String> uploadMetadata(@RequestParam("file") MultipartFile file, @RequestParam("registrationId") String registrationId) {
        try {
            // 从上传文件流解析元数据
            RelyingPartyRegistration registration = RelyingPartyRegistrations.fromMetadataLocation(file.getInputStream())
                    .registrationId(registrationId)
                    .build();
            dynamicRepo.addRegistration(registration);
            return ResponseEntity.ok("SAML提供商注册成功");
        } catch (Exception e) {
            return ResponseEntity.badRequest().body("元数据解析失败：" + e.getMessage());
        }
    }
}

关键注意事项 #

• 必须保证Repository内部存储是线程安全的（如ConcurrentHashMap），避免并发上传时出现数据不一致。
• 元数据解析时要处理异常（格式错误、重复ID等），避免破坏现有注册信息。
• Saml2MetadataFilter依赖的Resolver必须和Spring Security使用同一个动态Repository，否则元数据端点无法返回新添加的提供商信息。

内容的提问来源于stack exchange，提问作者gbids