Spring Security SAML2 Provider：InResponseTo验证及SameSite会话丢失问题求助

1. 自定义SAML2请求存储替代HttpSession #

Spring Security默认用HttpSessionSaml2AuthenticationRequestRepository存储认证请求，你可以实现自定义的Saml2AuthenticationRequestRepository，将请求存入带SameSite属性的Cookie或Redis等分布式存储，规避会话丢失问题。

示例代码（Cookie存储实现）：

public class CookieBasedSaml2RequestRepository implements Saml2AuthenticationRequestRepository<Saml2AuthenticationRequest> {
    private final CookieSerializer cookieSerializer = new DefaultCookieSerializer();

    public CookieBasedSaml2RequestRepository() {
        cookieSerializer.setSameSite("Lax"); // 匹配项目的SameSite配置
        cookieSerializer.setCookieName("SAML_AUTH_REQUEST");
        cookieSerializer.setDomain("your-app-domain.com");
        cookieSerializer.setHttpOnly(true);
        cookieSerializer.setSecure(true); // 生产环境必须开启，配合HTTPS
    }

    @Override
    public Saml2AuthenticationRequest loadAuthenticationRequest(HttpServletRequest request) {
        Cookie cookie = WebUtils.getCookie(request, "SAML_AUTH_REQUEST");
        if (cookie == null) {
            return null;
        }
        try {
            byte[] decoded = Base64.getUrlDecoder().decode(cookie.getValue());
            return SerializationUtils.deserialize(decoded);
        } catch (Exception e) {
            return null;
        }
    }

    @Override
    public void saveAuthenticationRequest(Saml2AuthenticationRequest request, HttpServletRequest req, HttpServletResponse res) {
        byte[] serialized = SerializationUtils.serialize(request);
        String encoded = Base64.getUrlEncoder().encodeToString(serialized);
        cookieSerializer.writeCookieValue(new CookieValue(req, res, encoded));
    }

    @Override
    public Saml2AuthenticationRequest removeAuthenticationRequest(HttpServletRequest req, HttpServletResponse res) {
        Saml2AuthenticationRequest request = loadAuthenticationRequest(req);
        cookieSerializer.writeCookieValue(new CookieValue(req, res, ""));
        return request;
    }
}

在Security配置中替换默认存储：

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .saml2Login(saml2 -> saml2
                .authenticationRequestRepository(new CookieBasedSaml2RequestRepository())
            );
    }
}

2. 禁用InResponseTo验证（仅应急使用） #

该方法会降低SAML认证的安全性，仅适合临时应急场景。通过自定义Saml2AuthenticationResponseValidator跳过InResponseTo字段校验：

示例代码：

@Component
public class CustomSamlResponseValidator implements Saml2AuthenticationResponseValidator {
    private final Saml2AuthenticationResponseValidator defaultValidator = new OpenSamlAuthenticationResponseValidator();

    @Override
    public Saml2AuthenticationResponseValidatorResult validate(Saml2AuthenticationResponse response, HttpServletRequest request) {
        Saml2AuthenticationResponseValidatorResult result = defaultValidator.validate(response, request);
        // 过滤掉InResponseTo相关的错误
        List<Saml2Error> filteredErrors = result.getErrors().stream()
            .filter(error -> !error.getErrorCode().equals(Saml2ErrorCodes.INVALID_IN_RESPONSE_TO))
            .collect(Collectors.toList());
        return new Saml2AuthenticationResponseValidatorResult(filteredErrors);
    }
}

配置到SAML2登录流程：

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private CustomSamlResponseValidator customValidator;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .saml2Login(saml2 -> saml2
                .authenticationResponseValidator(customValidator)
            );
    }
}

3. 调整SameSite配置的例外规则 #

如果外部配置允许，可针对SAML回调路径单独设置SameSite=None（需配合Secure Cookie）。SAML响应由第三方身份提供商发起跨域请求，SameSite=None可确保Cookie正常携带，但必须保证Cookie开启Secure属性（仅在HTTPS下生效）。

内容的提问来源于stack exchange，提问作者inabumst