Spring Security SAML Assertion中groups属性转Roles角色的配置问题

Spring Security SAML2模块默认仅会生成ROLE_USER权限，不会主动解析SAML断言中的自定义groups属性，需要自定义权限映射逻辑实现用户组到Spring Security权限的转换。

步骤1：实现自定义权限映射器 #

实现GrantedAuthoritiesMapper接口，从SAML断言中提取groups属性并转换为权限对象：

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticatedPrincipal;

import java.util.ArrayList;
import java.util.Collection;
import java.util.List;

public class OktaGroup2AuthoritiesMapper implements GrantedAuthoritiesMapper {
    @Override
    public Collection<? extends GrantedAuthority> mapAuthorities(Collection<? extends GrantedAuthority> authorities) {
        List<GrantedAuthority> result = new ArrayList<>();
        // 可选：保留默认的ROLE_USER权限
        result.addAll(authorities);

        for (GrantedAuthority auth : authorities) {
            if (auth instanceof Saml2AuthenticatedPrincipal) {
                Saml2AuthenticatedPrincipal principal = (Saml2AuthenticatedPrincipal) auth;
                // 提取断言中的groups属性
                List<String> groups = principal.getAttribute("groups");
                if (groups != null) {
                    groups.stream()
                            // 按Spring Security规则添加ROLE_前缀、转换为大写，可按需调整
                            .map(group -> new SimpleGrantedAuthority("ROLE_" + group.trim().toUpperCase()))
                            .forEach(result::add);
                }
                break;
            }
        }
        return result;
    }
}

步骤2：将映射器注入SAML2登录配置 #

修改Spring Security配置类，将自定义映射器绑定到SAML2登录流程：

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests(auth -> auth
                        // 示例：配置角色访问规则
                        .antMatchers("/admin/**").hasRole("ADMIN")
                        .anyRequest().authenticated()
                )
                .saml2Login(saml2 -> saml2
                        // 绑定自定义权限映射器
                        .authoritiesMapper(new OktaGroup2AuthoritiesMapper())
                );
    }
}

注意事项 #

• 需确保Okta侧的SAML属性配置中，用户组属性的名称为groups，若自定义了其他名称，需修改代码中getAttribute的入参
• 若不需要ROLE_前缀，可删除映射逻辑中的前缀拼接，后续鉴权时使用hasAuthority("ADMIN")替代hasRole("ADMIN")即可
• 可在映射逻辑中增加过滤规则，仅将需要的用户组转换为权限，减少无效权限生成

内容的提问来源于stack exchange，提问作者Viraj Shetty