Java Jersey Web/REST应用的SAML 2.0支持方案咨询

Great question! Adding SSO to a Jersey app doesn't have to be tied to Spring—here are your best options:

1. Use Pac4j (Recommended) #

Pac4j is a flexible Java security library with first-class SAML support and a dedicated Jersey integration. It handles most of the heavy lifting for SSO flows, including out-of-the-box integration with Okta and other IDPs.

Key Steps: #

• Add dependencies to your project (Maven example):

  <dependency>
      <groupId>org.pac4j</groupId>
      <artifactId>pac4j-core</artifactId>
      <version>5.7.0</version> <!-- Use latest stable version -->
  </dependency>
  <dependency>
      <groupId>org.pac4j</groupId>
      <artifactId>pac4j-saml</artifactId>
      <version>5.7.0</version>
  </dependency>
  <dependency>
      <groupId>org.pac4j</groupId>
      <artifactId>pac4j-jersey</artifactId>
      <version>5.7.0</version>
  </dependency>
  

• Configure the SAML2Client with your IDP's metadata (e.g., Okta's metadata URL), your service provider (SP) entity ID, and certificate details.
• Register Pac4j's Pac4jSecurityFilter in your Jersey app to protect endpoints that require authentication.
• Set up a callback endpoint (e.g., /callback) where Pac4j will process the SAML response from Okta and establish the user session.

Pac4j abstracts away low-level SAML details, so you won't have to handle assertion parsing or signature validation manually.

2. OpenSAML + Custom Jersey Integration #

If you prefer full control over the SAML flow, you can use OpenSAML (the de facto standard Java SAML library) and build a custom integration with Jersey. This requires more code but lets you tailor every step to your app's needs.

Key Steps: #

• Initialize OpenSAML's runtime on app startup (use org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport to bootstrap the library).
• Create a Jersey ContainerRequestFilter that checks for a valid SAML assertion in the user session. If missing, redirect the user to your IDP's SSO endpoint with a generated SAML authentication request.
• Implement a callback resource (e.g., /saml/callback) to receive the SAML response from the IDP. Use OpenSAML to validate the response's signature, check the assertion's validity (expiry, audience, etc.), and extract user attributes.
• Store the authenticated user's details in the session for subsequent requests.

For Okta, you'll need to import Okta's SAML metadata XML into your OpenSAML configuration to trust their signing certificate.

Can You Adapt Spring SAML for Non-Spring Jersey Apps? #

Short answer: Not easily. Spring SAML (now part of Spring Security SAML2) is deeply integrated with the Spring ecosystem—it relies on Spring's dependency injection, security filter chain, and context management. Using it in a non-Spring app would require pulling in core Spring modules (like Spring Context and Spring Security) and essentially turning your Jersey app into a Spring-powered one (e.g., using Spring Jersey). This adds unnecessary complexity unless you're already planning to migrate to Spring.

Stick with Pac4j or OpenSAML for a cleaner, more lightweight integration with your existing Jersey setup.

内容的提问来源于stack exchange，提问作者B Singh