非Spring Boot环境下Spring Framework配置Spring Security 5+ SAML的文档问询

Spring Security 5.7及以上版本的内置SAML2支持本身完全不依赖Spring Boot，官方提供的Spring Boot配置文档本质上只是对原生配置能力的自动封装，完全可以基于原生Spring Framework环境完成配置，不需要引入任何Spring Boot相关依赖。 #

核心依赖配置 #

仅需引入如下核心依赖即可，无需引入Spring Boot的SAML starter包：

• Spring Framework 基础模块：spring-core、spring-context、spring-webmvc，版本建议选择5.3.x及以上稳定版，需与Spring Security版本兼容
• Spring Security 基础模块：spring-security-web、spring-security-config，版本要求5.7.x及以上
• SAML2 核心支持模块：spring-security-saml2-service-provider
• 可选依赖：如果需要自定义OpenSAML能力，补充opensaml-core、opensaml-saml-api、opensaml-saml-impl，版本需与Spring Security依赖的OpenSAML版本保持一致。

JavaConfig 核心配置 #

以下是无Spring Boot环境下的最小可用配置示例：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.saml2.core.Saml2X509Credential;
import org.springframework.security.saml2.provider.service.metadata.OpenSamlMetadataResolver;
import org.springframework.security.saml2.provider.service.registration.InMemoryRelyingPartyRegistrationRepository;
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
import org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter;
import org.springframework.security.saml2.provider.service.web.DefaultRelyingPartyRegistrationResolver;
import org.springframework.security.saml2.provider.service.web.Saml2MetadataFilter;
import org.springframework.security.web.SecurityFilterChain;
import java.security.PrivateKey;
import java.security.cert.X509Certificate;
import static org.springframework.security.config.Customizer.withDefaults;

@Configuration
@EnableWebSecurity
public class Saml2SecurityConfig {

    // 注册依赖方（SP）与身份提供方（IDP）的核心配置
    @Bean
    public RelyingPartyRegistrationRepository relyingPartyRegistrationRepository() {
        // 加载SP端签名、解密用的私钥与证书，IDP端签名验证证书
        Saml2X509Credential spSignCredential = Saml2X509Credential.signing(getSpPrivateKey(), getSpCert());
        Saml2X509Credential spDecryptCredential = Saml2X509Credential.decryption(getSpPrivateKey(), getSpCert());
        Saml2X509Credential idpVerifyCredential = Saml2X509Credential.verification(getIdpCert());

        RelyingPartyRegistration registration = RelyingPartyRegistration.withRegistrationId("custom-sp-id")
                .entityId("your-sp-entity-id")
                .assertionConsumerServiceLocation("https://your-service-domain/login/saml2/sso/custom-sp-id")
                .singleLogoutServiceLocation("https://your-service-domain/logout/saml2/slo/custom-sp-id")
                .signingX509Credentials(cred -> cred.add(spSignCredential))
                .decryptionX509Credentials(cred -> cred.add(spDecryptCredential))
                .assertingPartyDetails(idp -> idp
                        .entityId("your-idp-entity-id")
                        .singleSignOnServiceLocation("https://your-idp-domain/sso/saml2/login")
                        .singleLogoutServiceLocation("https://your-idp-domain/sso/saml2/logout")
                        .verificationX509Credentials(cred -> cred.add(idpVerifyCredential))
                )
                .build();
        return new InMemoryRelyingPartyRegistrationRepository(registration);
    }

    // 配置安全过滤链
    @Bean
    public SecurityFilterChain samlSecurityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
            // 启用SAML2登录能力
            .saml2Login(withDefaults())
            // 可选：启用SAML2单点登出能力
            .saml2Logout(withDefaults());

        // 手动注册SAML元数据端点过滤器（Spring Boot会自动注册，原生环境需手动添加）
        Saml2MetadataFilter metadataFilter = new Saml2MetadataFilter(
                new DefaultRelyingPartyRegistrationResolver(relyingPartyRegistrationRepository()),
                new OpenSamlMetadataResolver()
        );
        metadataFilter.setRequestMatcher("/saml2/service-provider-metadata/{registrationId}");
        http.addFilterBefore(metadataFilter, Saml2WebSsoAuthenticationFilter.class);

        return http.build();
    }

    // 自行实现如下工具方法，从自定义配置文件、本地证书文件、配置中心等位置加载对应的私钥与证书，无需依赖Spring Boot的配置绑定能力
    private PrivateKey getSpPrivateKey() { /* 自行实现加载逻辑 */ }
    private X509Certificate getSpCert() { /* 自行实现加载逻辑 */ }
    private X509Certificate getIdpCert() { /* 自行实现加载逻辑 */ }
}

如果是传统XML配置的Spring项目，可将上述JavaConfig转换为XML Bean定义，核心是注册RelyingPartyRegistrationRepository与SecurityFilterChain两个核心Bean即可。 #

Servlet 容器适配 #

基于web.xml的传统项目 #

在web.xml中添加Spring Security过滤器映射即可：

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

基于Servlet3.0+注解驱动的项目 #

实现WebApplicationInitializer接口，手动注册DelegatingFilterProxy过滤器即可，无需修改web.xml。 #

常见问题说明 #

• 所有配置项都可以自行实现读取逻辑，不需要依赖Spring Boot的application.properties/application.yml配置体系
• 不需要保留旧版spring-security-saml扩展包的任何依赖，所有SAML能力均由Spring Security 5+原生提供
• 如果遇到类冲突问题，优先检查OpenSAML版本是否与Spring Security依赖的版本一致，不要随意升级OpenSAML版本

内容的提问来源于stack exchange，提问作者csyperski