Skip to content

Commit 864af59

Browse files
Lasse Lindqvistphilwebb
Lasse Lindqvist
authored and
philwebb
committed
Choose SAML party based on entity ID rather than always using first
Update `Saml2RelyingPartyRegistrationConfiguration` so that `RelyingPartyRegistrations` uses `collectionFromMetadataLocation` rather than `fromMetadataLocation` and searches candidates for a matching entity ID. Prior to this commit, it was possible for the wrong provider to be used if multiple candidates existed in the returned metadata. See gh-35902
1 parent 51ee702 commit 864af59

File tree

3 files changed

+144
-3
lines changed

3 files changed

+144
-3
lines changed

‎spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/saml2/Saml2RelyingPartyRegistrationConfiguration.java

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -88,9 +88,14 @@ private RelyingPartyRegistration asRegistration(Map.Entry<String, Registration>
8888
private RelyingPartyRegistration asRegistration(String id, Registration properties) {
8989
AssertingPartyProperties assertingParty = new AssertingPartyProperties(properties, id);
9090
boolean usingMetadata = StringUtils.hasText(assertingParty.getMetadataUri());
91-
Builder builder = (usingMetadata)
92-
? RelyingPartyRegistrations.fromMetadataLocation(assertingParty.getMetadataUri()).registrationId(id)
93-
: RelyingPartyRegistration.withRegistrationId(id);
91+
Builder builder = (usingMetadata) ? RelyingPartyRegistrations
92+
.collectionFromMetadataLocation(properties.getAssertingparty().getMetadataUri())
93+
.stream()
94+
.filter(b -> entityIdsMatch(properties, b))
95+
.findFirst()
96+
.orElseThrow(() -> new IllegalStateException(
97+
"No relying party with entity-id " + properties.getEntityId() + " found."))
98+
.registrationId(id) : RelyingPartyRegistration.withRegistrationId(id);
9499
builder.assertionConsumerServiceLocation(properties.getAcs().getLocation());
95100
builder.assertionConsumerServiceBinding(properties.getAcs().getBinding());
96101
builder.assertingPartyDetails(mapAssertingParty(properties, id, usingMetadata));
@@ -119,6 +124,19 @@ private RelyingPartyRegistration asRegistration(String id, Registration properti
119124
return registration;
120125
}
121126

127+
/**
128+
* Tests if the builder would have the correct entity-id. If no entity-id is given in
129+
* properties, any builder passes the test.
130+
* @param properties the properties
131+
* @param b the builder
132+
* @return true if the builder passes the test
133+
*/
134+
private boolean entityIdsMatch(Registration properties, Builder b) {
135+
RelyingPartyRegistration rpr = b.build();
136+
return properties.getAssertingparty().getEntityId() == null
137+
|| properties.getAssertingparty().getEntityId().equals(rpr.getAssertingPartyDetails().getEntityId());
138+
}
139+
122140
private Consumer<AssertingPartyDetails.Builder> mapAssertingParty(Registration registration, String id,
123141
boolean usingMetadata) {
124142
return (details) -> {

‎spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/saml2/Saml2RelyingPartyAutoConfigurationTests.java

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -402,6 +402,43 @@ void samlLogoutShouldBeConfigured() {
402402
this.contextRunner.withPropertyValues(getPropertyValues(false))
403403
.run((context) -> assertThat(hasFilter(context, Saml2LogoutRequestFilter.class)).isTrue());
404404
}
405+
406+
@Test
407+
void autoconfigurationShouldWorkWithMultipleProvidersWithNoEntityId() throws Exception {
408+
try (MockWebServer server = new MockWebServer()) {
409+
server.start();
410+
String metadataUrl = server.url("").toString();
411+
setupMockResponse(server, new ClassPathResource("saml/idp-metadata-with-multiple-providers"));
412+
this.contextRunner.withPropertyValues(PREFIX + ".foo.assertingparty.metadata-uri=" + metadataUrl)
413+
.run((context) -> {
414+
assertThat(context).hasSingleBean(RelyingPartyRegistrationRepository.class);
415+
assertThat(server.getRequestCount()).isOne();
416+
RelyingPartyRegistrationRepository repository = context.getBean(RelyingPartyRegistrationRepository.class);
417+
RelyingPartyRegistration registration = repository.findByRegistrationId("foo");
418+
assertThat(registration.getAssertingPartyDetails().getEntityId())
419+
.isEqualTo("https://idp.example.com/idp/shibboleth");
420+
});
421+
}
422+
}
423+
424+
@Test
425+
void autoconfigurationShouldWorkWithMultipleProviders() throws Exception {
426+
try (MockWebServer server = new MockWebServer()) {
427+
server.start();
428+
String metadataUrl = server.url("").toString();
429+
setupMockResponse(server, new ClassPathResource("saml/idp-metadata-with-multiple-providers"));
430+
this.contextRunner.withPropertyValues(PREFIX + ".foo.assertingparty.metadata-uri=" + metadataUrl,
431+
PREFIX + ".foo.assertingparty.entity-id=https://idp2.example.com/idp/shibboleth")
432+
.run((context) -> {
433+
assertThat(context).hasSingleBean(RelyingPartyRegistrationRepository.class);
434+
assertThat(server.getRequestCount()).isOne();
435+
RelyingPartyRegistrationRepository repository = context.getBean(RelyingPartyRegistrationRepository.class);
436+
RelyingPartyRegistration registration = repository.findByRegistrationId("foo");
437+
assertThat(registration.getAssertingPartyDetails().getEntityId())
438+
.isEqualTo("https://idp2.example.com/idp/shibboleth");
439+
});
440+
}
441+
}
405442

406443
private String[] getPropertyValuesWithoutSigningCredentials(boolean signRequests, boolean useDeprecated) {
407444
String assertingParty = useDeprecated ? "identityprovider" : "assertingparty";

‎spring-boot-project/spring-boot-autoconfigure/src/test/resources/saml/idp-metadata-with-multiple-providers

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
<EntitiesDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="virtu-20230614094100" Name="virtu" validUntil="2023-07-12T06:41:00Z" xsi:schemaLocation="urn:oasis:names:tc:SAML:2.0:metadata saml-schema-metadata-2.0.xsd http://www.w3.org/2000/09/xmldsig# xmldsig-core-schema.xsd">
2+
<md:EntityDescriptor entityID="https://idp.example.com/idp/shibboleth"
3+
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
6+
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
7+
xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui">
8+
<md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
9+
<md:KeyDescriptor>
10+
<ds:KeyInfo>
11+
<ds:X509Data>
12+
<ds:X509Certificate>
13+
MIIDZjCCAk6gAwIBAgIVAL9O+PA7SXtlwZZY8MVSE9On1cVWMA0GCSqGSIb3DQEB
14+
BQUAMCkxJzAlBgNVBAMTHmlkZW0tcHVwYWdlbnQuZG16LWludC51bmltby5pdDAe
15+
Fw0xMzA3MjQwMDQ0MTRaFw0zMzA3MjQwMDQ0MTRaMCkxJzAlBgNVBAMTHmlkZW0t
16+
cHVwYWdlbnQuZG16LWludC51bmltby5pdDCCASIwDQYJKoZIhvcNAMIIDQADggEP
17+
ADCCAQoCggEBAIAcp/VyzZGXUF99kwj4NvL/Rwv4YvBgLWzpCuoxqHZ/hmBwJtqS
18+
v0y9METBPFbgsF3hCISnxbcmNVxf/D0MoeKtw1YPbsUmow/bFe+r72hZ+IVAcejN
19+
iDJ7t5oTjsRN1t1SqvVVk6Ryk5AZhpFW+W9pE9N6c7kJ16Rp2/mbtax9OCzxpece
20+
byi1eiLfIBmkcRawL/vCc2v6VLI18i6HsNVO3l2yGosKCbuSoGDx2fCdAOk/rgdz
21+
cWOvFsIZSKuD+FVbSS/J9GVs7yotsS4PRl4iX9UMnfDnOMfO7bcBgbXtDl4SCU1v
22+
dJrRw7IL/pLz34Rv9a8nYitrzrxtLOp3nYUCAwEAAaOBhDCBgTBgBgMIIDEEWTBX
23+
gh5pZGVtLXB1cGFnZW50LmRtei1pbnQudW5pbW8uaXSGNWh0dHBzOi8vaWRlbS1w
24+
dXBhZ2VudC5kbXotaW50LnVuaW1vLml0L2lkcC9zaGliYm9sZXRoMB0GA1UdDgQW
25+
BBT8PANzz+adGnTRe8ldcyxAwe4VnzANBgkqhkiG9w0BAQUFAAOCAQEAOEnO8Clu
26+
9z/Lf/8XOOsTdxJbV29DIF3G8KoQsB3dBsLwPZVEAQIP6ceS32Xaxrl6FMTDDNkL
27+
qUvvInUisw0+I5zZwYHybJQCletUWTnz58SC4C9G7FpuXHFZnOGtRcgGD1NOX4UU
28+
duus/4nVcGSLhDjszZ70Xtj0gw2Sn46oQPHTJ81QZ3Y9ih+Aj1c9OtUSBwtWZFkU
29+
yooAKoR8li68Yb21zN2N65AqV+ndL98M8xUYMKLONuAXStDeoVCipH6PJ09Z5U2p
30+
V5p4IQRV6QBsNw9CISJFuHzkVYTH5ZxzN80Ru46vh4y2M0Nu8GQ9I085KoZkrf5e
31+
Cq53OZt9ISjHEw==
32+
</ds:X509Certificate>
33+
</ds:X509Data>
34+
</ds:KeyInfo>
35+
</md:KeyDescriptor>
36+
<md:SingleSignOnService
37+
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
38+
Location="https://idp.example.com/sso"/>
39+
</md:IDPSSODescriptor>
40+
<md:ContactPerson contactType="technical">
41+
<md:EmailAddress>mailto:[email protected]</md:EmailAddress>
42+
</md:ContactPerson>
43+
</md:EntityDescriptor>
44+
<md:EntityDescriptor entityID="https://idp2.example.com/idp/shibboleth"
45+
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
46+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
47+
xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
48+
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
49+
xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui">
50+
<md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
51+
<md:KeyDescriptor>
52+
<ds:KeyInfo>
53+
<ds:X509Data>
54+
<ds:X509Certificate>
55+
MIIDZjCCAk6gAwIBAgIVAL9O+PA7SXtlwZZY8MVSE9On1cVWMA0GCSqGSIb3DQEB
56+
BQUAMCkxJzAlBgNVBAMTHmlkZW0tcHVwYWdlbnQuZG16LWludC51bmltby5pdDAe
57+
Fw0xMzA3MjQwMDQ0MTRaFw0zMzA3MjQwMDQ0MTRaMCkxJzAlBgNVBAMTHmlkZW0t
58+
cHVwYWdlbnQuZG16LWludC51bmltby5pdDCCASIwDQYJKoZIhvcNAMIIDQADggEP
59+
ADCCAQoCggEBAIAcp/VyzZGXUF99kwj4NvL/Rwv4YvBgLWzpCuoxqHZ/hmBwJtqS
60+
v0y9METBPFbgsF3hCISnxbcmNVxf/D0MoeKtw1YPbsUmow/bFe+r72hZ+IVAcejN
61+
iDJ7t5oTjsRN1t1SqvVVk6Ryk5AZhpFW+W9pE9N6c7kJ16Rp2/mbtax9OCzxpece
62+
byi1eiLfIBmkcRawL/vCc2v6VLI18i6HsNVO3l2yGosKCbuSoGDx2fCdAOk/rgdz
63+
cWOvFsIZSKuD+FVbSS/J9GVs7yotsS4PRl4iX9UMnfDnOMfO7bcBgbXtDl4SCU1v
64+
dJrRw7IL/pLz34Rv9a8nYitrzrxtLOp3nYUCAwEAAaOBhDCBgTBgBgMIIDEEWTBX
65+
gh5pZGVtLXB1cGFnZW50LmRtei1pbnQudW5pbW8uaXSGNWh0dHBzOi8vaWRlbS1w
66+
dXBhZ2VudC5kbXotaW50LnVuaW1vLml0L2lkcC9zaGliYm9sZXRoMB0GA1UdDgQW
67+
BBT8PANzz+adGnTRe8ldcyxAwe4VnzANBgkqhkiG9w0BAQUFAAOCAQEAOEnO8Clu
68+
9z/Lf/8XOOsTdxJbV29DIF3G8KoQsB3dBsLwPZVEAQIP6ceS32Xaxrl6FMTDDNkL
69+
qUvvInUisw0+I5zZwYHybJQCletUWTnz58SC4C9G7FpuXHFZnOGtRcgGD1NOX4UU
70+
duus/4nVcGSLhDjszZ70Xtj0gw2Sn46oQPHTJ81QZ3Y9ih+Aj1c9OtUSBwtWZFkU
71+
yooAKoR8li68Yb21zN2N65AqV+ndL98M8xUYMKLONuAXStDeoVCipH6PJ09Z5U2p
72+
V5p4IQRV6QBsNw9CISJFuHzkVYTH5ZxzN80Ru46vh4y2M0Nu8GQ9I085KoZkrf5e
73+
Cq53OZt9ISjHEw==
74+
</ds:X509Certificate>
75+
</ds:X509Data>
76+
</ds:KeyInfo>
77+
</md:KeyDescriptor>
78+
<md:SingleSignOnService
79+
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
80+
Location="https://idp2.example.com/sso"/>
81+
</md:IDPSSODescriptor>
82+
<md:ContactPerson contactType="technical">
83+
<md:EmailAddress>mailto:[email protected]</md:EmailAddress>
84+
</md:ContactPerson>
85+
</md:EntityDescriptor>
86+
</EntitiesDescriptor>

0 commit comments

Comments
 (0)