Skip to content

Commit 3ad6c6c

Browse files
jzheauxjzheaux
committed
Use EntityId-lookup Components
Closes gh-12880
1 parent dbdf04f commit 3ad6c6c

File tree

7 files changed

+83
-179
lines changed

7 files changed

+83
-179
lines changed

‎config/src/main/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurer.java

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,8 @@
3333
import org.springframework.security.saml2.provider.service.authentication.OpenSaml4AuthenticationProvider;
3434
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
3535
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
36-
import org.springframework.security.saml2.provider.service.web.DefaultRelyingPartyRegistrationResolver;
3736
import org.springframework.security.saml2.provider.service.web.HttpSessionSaml2AuthenticationRequestRepository;
38-
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationResolver;
37+
import org.springframework.security.saml2.provider.service.web.OpenSamlAuthenticationTokenConverter;
3938
import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationRequestRepository;
4039
import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationTokenConverter;
4140
import org.springframework.security.saml2.provider.service.web.Saml2WebSsoAuthenticationRequestFilter;
@@ -292,11 +291,6 @@ public void configure(B http) throws Exception {
292291
}
293292
}
294293

295-
private RelyingPartyRegistrationResolver relyingPartyRegistrationResolver(B http) {
296-
RelyingPartyRegistrationRepository registrations = relyingPartyRegistrationRepository(http);
297-
return new DefaultRelyingPartyRegistrationResolver(registrations);
298-
}
299-
300294
RelyingPartyRegistrationRepository relyingPartyRegistrationRepository(B http) {
301295
if (this.relyingPartyRegistrationRepository == null) {
302296
this.relyingPartyRegistrationRepository = getSharedOrBean(http, RelyingPartyRegistrationRepository.class);
@@ -339,7 +333,7 @@ private Saml2AuthenticationRequestResolver getAuthenticationRequestResolver(B ht
339333
return bean;
340334
}
341335
OpenSaml4AuthenticationRequestResolver openSaml4AuthenticationRequestResolver = new OpenSaml4AuthenticationRequestResolver(
342-
relyingPartyRegistrationResolver(http));
336+
relyingPartyRegistrationRepository(http));
343337
openSaml4AuthenticationRequestResolver
344338
.setRequestMatcher(new AntPathRequestMatcher(this.authenticationRequestUri));
345339
return openSaml4AuthenticationRequestResolver;
@@ -352,10 +346,14 @@ private AuthenticationConverter getAuthenticationConverter(B http) {
352346
AuthenticationConverter authenticationConverterBean = getBeanOrNull(http,
353347
Saml2AuthenticationTokenConverter.class);
354348
if (authenticationConverterBean == null) {
355-
Assert.state(this.loginProcessingUrl.contains("{registrationId}"),
356-
"loginProcessingUrl must contain {registrationId} path variable");
357-
return new Saml2AuthenticationTokenConverter(
358-
new DefaultRelyingPartyRegistrationResolver(this.relyingPartyRegistrationRepository));
349+
authenticationConverterBean = getBeanOrNull(http, OpenSamlAuthenticationTokenConverter.class);
350+
}
351+
if (authenticationConverterBean == null) {
352+
OpenSamlAuthenticationTokenConverter converter = new OpenSamlAuthenticationTokenConverter(
353+
this.relyingPartyRegistrationRepository);
354+
converter.setAuthenticationRequestRepository(getAuthenticationRequestRepository(http));
355+
converter.setRequestMatcher(createLoginProcessingUrlMatcher(this.loginProcessingUrl));
356+
return converter;
359357
}
360358
return authenticationConverterBean;
361359
}

‎config/src/main/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LogoutConfigurer.java

Lines changed: 19 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -39,11 +39,10 @@
3939
import org.springframework.security.saml2.provider.service.authentication.logout.Saml2LogoutResponseValidator;
4040
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
4141
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
42-
import org.springframework.security.saml2.provider.service.web.DefaultRelyingPartyRegistrationResolver;
43-
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationResolver;
4442
import org.springframework.security.saml2.provider.service.web.authentication.logout.HttpSessionLogoutRequestRepository;
4543
import org.springframework.security.saml2.provider.service.web.authentication.logout.OpenSaml4LogoutRequestResolver;
4644
import org.springframework.security.saml2.provider.service.web.authentication.logout.OpenSaml4LogoutResponseResolver;
45+
import org.springframework.security.saml2.provider.service.web.authentication.logout.OpenSamlLogoutRequestValidatorParametersResolver;
4746
import org.springframework.security.saml2.provider.service.web.authentication.logout.Saml2LogoutRequestFilter;
4847
import org.springframework.security.saml2.provider.service.web.authentication.logout.Saml2LogoutRequestRepository;
4948
import org.springframework.security.saml2.provider.service.web.authentication.logout.Saml2LogoutRequestResolver;
@@ -216,17 +215,12 @@ public void configure(H http) throws Exception {
216215
this.logoutHandlers = logout.getLogoutHandlers();
217216
this.logoutSuccessHandler = logout.getLogoutSuccessHandler();
218217
}
219-
RelyingPartyRegistrationResolver registrations = relyingPartyRegistrationResolver(http);
218+
RelyingPartyRegistrationRepository registrations = getRelyingPartyRegistrationRepository(http);
220219
http.addFilterBefore(createLogoutRequestProcessingFilter(registrations), CsrfFilter.class);
221220
http.addFilterBefore(createLogoutResponseProcessingFilter(registrations), CsrfFilter.class);
222221
http.addFilterBefore(createRelyingPartyLogoutFilter(registrations), LogoutFilter.class);
223222
}
224223

225-
private RelyingPartyRegistrationResolver relyingPartyRegistrationResolver(H http) {
226-
RelyingPartyRegistrationRepository registrations = getRelyingPartyRegistrationRepository(http);
227-
return new DefaultRelyingPartyRegistrationResolver(registrations);
228-
}
229-
230224
private RelyingPartyRegistrationRepository getRelyingPartyRegistrationRepository(H http) {
231225
if (this.relyingPartyRegistrationRepository != null) {
232226
return this.relyingPartyRegistrationRepository;
@@ -242,26 +236,29 @@ private RelyingPartyRegistrationRepository getRelyingPartyRegistrationRepository
242236
}
243237

244238
private Saml2LogoutRequestFilter createLogoutRequestProcessingFilter(
245-
RelyingPartyRegistrationResolver registrations) {
239+
RelyingPartyRegistrationRepository registrations) {
246240
LogoutHandler[] logoutHandlers = this.logoutHandlers.toArray(new LogoutHandler[0]);
247241
Saml2LogoutResponseResolver logoutResponseResolver = createSaml2LogoutResponseResolver(registrations);
248-
Saml2LogoutRequestFilter filter = new Saml2LogoutRequestFilter(registrations,
242+
RequestMatcher requestMatcher = createLogoutRequestMatcher();
243+
OpenSamlLogoutRequestValidatorParametersResolver parameters = new OpenSamlLogoutRequestValidatorParametersResolver(
244+
registrations);
245+
parameters.setRequestMatcher(requestMatcher);
246+
Saml2LogoutRequestFilter filter = new Saml2LogoutRequestFilter(parameters,
249247
this.logoutRequestConfigurer.logoutRequestValidator(), logoutResponseResolver, logoutHandlers);
250-
filter.setLogoutRequestMatcher(createLogoutRequestMatcher());
251248
filter.setSecurityContextHolderStrategy(getSecurityContextHolderStrategy());
252249
return postProcess(filter);
253250
}
254251

255252
private Saml2LogoutResponseFilter createLogoutResponseProcessingFilter(
256-
RelyingPartyRegistrationResolver registrations) {
253+
RelyingPartyRegistrationRepository registrations) {
257254
Saml2LogoutResponseFilter logoutResponseFilter = new Saml2LogoutResponseFilter(registrations,
258255
this.logoutResponseConfigurer.logoutResponseValidator(), this.logoutSuccessHandler);
259256
logoutResponseFilter.setLogoutRequestMatcher(createLogoutResponseMatcher());
260257
logoutResponseFilter.setLogoutRequestRepository(this.logoutRequestConfigurer.logoutRequestRepository);
261258
return postProcess(logoutResponseFilter);
262259
}
263260

264-
private LogoutFilter createRelyingPartyLogoutFilter(RelyingPartyRegistrationResolver registrations) {
261+
private LogoutFilter createRelyingPartyLogoutFilter(RelyingPartyRegistrationRepository registrations) {
265262
LogoutHandler[] logoutHandlers = this.logoutHandlers.toArray(new LogoutHandler[0]);
266263
Saml2RelyingPartyInitiatedLogoutSuccessHandler logoutRequestSuccessHandler = createSaml2LogoutRequestSuccessHandler(
267264
registrations);
@@ -290,15 +287,15 @@ private RequestMatcher createLogoutResponseMatcher() {
290287
}
291288

292289
private Saml2RelyingPartyInitiatedLogoutSuccessHandler createSaml2LogoutRequestSuccessHandler(
293-
RelyingPartyRegistrationResolver relyingPartyRegistrationResolver) {
290+
RelyingPartyRegistrationRepository registrations) {
294291
Saml2LogoutRequestResolver logoutRequestResolver = this.logoutRequestConfigurer
295-
.logoutRequestResolver(relyingPartyRegistrationResolver);
292+
.logoutRequestResolver(registrations);
296293
return new Saml2RelyingPartyInitiatedLogoutSuccessHandler(logoutRequestResolver);
297294
}
298295

299296
private Saml2LogoutResponseResolver createSaml2LogoutResponseResolver(
300-
RelyingPartyRegistrationResolver relyingPartyRegistrationResolver) {
301-
return this.logoutResponseConfigurer.logoutResponseResolver(relyingPartyRegistrationResolver);
297+
RelyingPartyRegistrationRepository registrations) {
298+
return this.logoutResponseConfigurer.logoutResponseResolver(registrations);
302299
}
303300

304301
private <C> C getBeanOrNull(Class<C> clazz) {
@@ -385,12 +382,11 @@ private Saml2LogoutRequestValidator logoutRequestValidator() {
385382
return this.logoutRequestValidator;
386383
}
387384

388-
private Saml2LogoutRequestResolver logoutRequestResolver(
389-
RelyingPartyRegistrationResolver relyingPartyRegistrationResolver) {
385+
private Saml2LogoutRequestResolver logoutRequestResolver(RelyingPartyRegistrationRepository registrations) {
390386
if (this.logoutRequestResolver != null) {
391387
return this.logoutRequestResolver;
392388
}
393-
return new OpenSaml4LogoutRequestResolver(relyingPartyRegistrationResolver);
389+
return new OpenSaml4LogoutRequestResolver(registrations);
394390
}
395391

396392
}
@@ -454,10 +450,9 @@ private Saml2LogoutResponseValidator logoutResponseValidator() {
454450
return this.logoutResponseValidator;
455451
}
456452

457-
private Saml2LogoutResponseResolver logoutResponseResolver(
458-
RelyingPartyRegistrationResolver relyingPartyRegistrationResolver) {
453+
private Saml2LogoutResponseResolver logoutResponseResolver(RelyingPartyRegistrationRepository registrations) {
459454
if (this.logoutResponseResolver == null) {
460-
return new OpenSaml4LogoutResponseResolver(relyingPartyRegistrationResolver);
455+
return new OpenSaml4LogoutResponseResolver(registrations);
461456
}
462457
return this.logoutResponseResolver;
463458
}

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurerTests.java

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@
3131
import org.junit.jupiter.api.extension.ExtendWith;
3232
import org.mockito.ArgumentCaptor;
3333

34-
import org.springframework.beans.factory.BeanCreationException;
3534
import org.springframework.beans.factory.annotation.Autowired;
3635
import org.springframework.context.ConfigurableApplicationContext;
3736
import org.springframework.context.annotation.Bean;
@@ -91,7 +90,6 @@
9190
import org.springframework.web.util.UriComponentsBuilder;
9291

9392
import static org.assertj.core.api.Assertions.assertThat;
94-
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
9593
import static org.mockito.ArgumentMatchers.any;
9694
import static org.mockito.BDDMockito.given;
9795
import static org.mockito.Mockito.atLeastOnce;
@@ -308,12 +306,9 @@ public void authenticationRequestWhenCustomAuthenticationRequestUriRepositoryThe
308306
}
309307

310308
@Test
311-
public void saml2LoginWhenLoginProcessingUrlWithoutRegistrationIdAndDefaultAuthenticationConverterThenValidates() {
312-
assertThatExceptionOfType(BeanCreationException.class)
313-
.isThrownBy(() -> this.spring.register(CustomLoginProcessingUrlDefaultAuthenticationConverter.class)
314-
.autowire())
315-
.havingRootCause().isInstanceOf(IllegalStateException.class)
316-
.withMessage("loginProcessingUrl must contain {registrationId} path variable");
309+
public void saml2LoginWhenLoginProcessingUrlWithoutRegistrationIdAndDefaultAuthenticationConverterThenAutowires()
310+
throws Exception {
311+
this.spring.register(CustomLoginProcessingUrlDefaultAuthenticationConverter.class).autowire();
317312
}
318313

319314
@Test

0 commit comments

Comments
 (0)