Spring Security SAML2中使用JKS Keystore及等效密钥管理器配置方法

Spring Security SAML2 没有单独提供JKSKeyManager同款组件，原有密钥管理器的能力已经整合进RelyingPartyRegistration的证书/密钥配置体系中，以下是纯Java配置的实现方式，完全匹配你给出的XML配置参数：

完整配置代码 #

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.io.ClassPathResource;
import org.springframework.security.saml2.core.Saml2X509Credential;
import org.springframework.security.saml2.provider.service.registration.InMemoryRelyingPartyRegistrationRepository;
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;

import java.security.KeyStore;
import java.security.PrivateKey;
import java.security.cert.X509Certificate;

@Configuration
public class Saml2Config {
    // JKS配置参数，和原XML完全对应
    private static final String KEYSTORE_PATH = "security/ssoKeystore_test.jks";
    private static final String KEYSTORE_PASSWORD = "client123";
    private static final String DEFAULT_KEY_ALIAS = "ssokey";
    private static final String DEFAULT_KEY_PASSWORD = "client123";

    @Bean
    public RelyingPartyRegistrationRepository relyingPartyRegistrationRepository() throws Exception {
        // 1. 加载JKS密钥库
        KeyStore keyStore = KeyStore.getInstance("JKS");
        keyStore.load(new ClassPathResource(KEYSTORE_PATH).getInputStream(), KEYSTORE_PASSWORD.toCharArray());

        // 2. 读取默认密钥对和证书
        PrivateKey privateKey = (PrivateKey) keyStore.getKey(DEFAULT_KEY_ALIAS, DEFAULT_KEY_PASSWORD.toCharArray());
        X509Certificate certificate = (X509Certificate) keyStore.getCertificate(DEFAULT_KEY_ALIAS);
        // 可根据密钥实际用途调整类型：签名/解密/两者都选
        Saml2X509Credential credential = new Saml2X509Credential(
                privateKey, 
                certificate, 
                Saml2X509Credential.Saml2X509CredentialType.SIGNING,
                Saml2X509Credential.Saml2X509CredentialType.DECRYPTION
        );

        // 3. 配置RelyingPartyRegistration，需补充你实际的IDP、SP元数据等其他业务配置
        RelyingPartyRegistration registration = RelyingPartyRegistration.withRegistrationId("your-sp-id")
                // 省略其他必填配置：entityId、ACS端点、IDP元数据等，按业务实际情况补充
                .signingX509Credentials(c -> c.add(credential))
                .decryptionX509Credentials(c -> c.add(credential))
                .build();

        return new InMemoryRelyingPartyRegistrationRepository(registration);
    }
}

多密钥适配说明 #

如果原配置的map下有多个密钥条目，只需循环读取所有别名对应的密钥对，依次添加到signingX509Credentials或decryptionX509Credentials集合中即可，框架会自动按优先级选择匹配的密钥进行签名、解密操作，完全等效原JKSKeyManager的多密钥存储能力。

内容的提问来源于stack exchange，提问作者mooor