Skip to content

Commit 506e50b

Browse files
jzheauxjzheaux
committed
Move Saml2 Authentication Filters
Issue spring-projectsgh-8819
1 parent bbac85e commit 506e50b

File tree

14 files changed

+488
-385
lines changed

14 files changed

+488
-385
lines changed

Diff for: ‎config/src/main/java/org/springframework/security/config/annotation/web/builders/FilterOrderRegistration.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -85,15 +85,15 @@ final class FilterOrderRegistration {
8585
"org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRedirectFilter",
8686
order.next());
8787
this.filterToOrder.put(
88-
"org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationRequestFilter",
88+
"org.springframework.security.saml2.provider.service.web.Saml2WebSsoAuthenticationRequestFilter",
8989
order.next());
9090
put(X509AuthenticationFilter.class, order.next());
9191
put(AbstractPreAuthenticatedProcessingFilter.class, order.next());
9292
this.filterToOrder.put("org.springframework.security.cas.web.CasAuthenticationFilter", order.next());
9393
this.filterToOrder.put("org.springframework.security.oauth2.client.web.OAuth2LoginAuthenticationFilter",
9494
order.next());
9595
this.filterToOrder.put(
96-
"org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter",
96+
"org.springframework.security.saml2.provider.service.web.authentication.Saml2WebSsoAuthenticationFilter",
9797
order.next());
9898
put(UsernamePasswordAuthenticationFilter.class, order.next());
9999
order.next(); // gh-8105

Diff for: ‎config/src/main/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurer.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -37,16 +37,16 @@
3737
import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationRequestFactory;
3838
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
3939
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
40-
import org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter;
41-
import org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationRequestFilter;
4240
import org.springframework.security.saml2.provider.service.web.DefaultRelyingPartyRegistrationResolver;
4341
import org.springframework.security.saml2.provider.service.web.DefaultSaml2AuthenticationRequestContextResolver;
4442
import org.springframework.security.saml2.provider.service.web.HttpSessionSaml2AuthenticationRequestRepository;
4543
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationResolver;
4644
import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationRequestContextResolver;
4745
import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationRequestRepository;
4846
import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationTokenConverter;
47+
import org.springframework.security.saml2.provider.service.web.Saml2WebSsoAuthenticationRequestFilter;
4948
import org.springframework.security.saml2.provider.service.web.authentication.Saml2AuthenticationRequestResolver;
49+
import org.springframework.security.saml2.provider.service.web.authentication.Saml2WebSsoAuthenticationFilter;
5050
import org.springframework.security.web.AuthenticationEntryPoint;
5151
import org.springframework.security.web.authentication.AuthenticationConverter;
5252
import org.springframework.security.web.authentication.DelegatingAuthenticationEntryPoint;

Diff for: ‎config/src/main/java/org/springframework/security/config/http/Saml2LoginBeanDefinitionParser.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@
3939
import org.springframework.security.config.Elements;
4040
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
4141
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
42-
import org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter;
43-
import org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationRequestFilter;
42+
import org.springframework.security.saml2.provider.service.web.Saml2WebSsoAuthenticationRequestFilter;
43+
import org.springframework.security.saml2.provider.service.web.authentication.Saml2WebSsoAuthenticationFilter;
4444
import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint;
4545
import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter;
4646
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;

Diff for: ‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurerTests.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -87,14 +87,14 @@
8787
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
8888
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
8989
import org.springframework.security.saml2.provider.service.registration.TestRelyingPartyRegistrations;
90-
import org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter;
9190
import org.springframework.security.saml2.provider.service.web.DefaultRelyingPartyRegistrationResolver;
9291
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationResolver;
9392
import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationRequestContextResolver;
9493
import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationRequestRepository;
9594
import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationTokenConverter;
9695
import org.springframework.security.saml2.provider.service.web.authentication.OpenSaml4AuthenticationRequestResolver;
9796
import org.springframework.security.saml2.provider.service.web.authentication.Saml2AuthenticationRequestResolver;
97+
import org.springframework.security.saml2.provider.service.web.authentication.Saml2WebSsoAuthenticationFilter;
9898
import org.springframework.security.web.FilterChainProxy;
9999
import org.springframework.security.web.SecurityFilterChain;
100100
import org.springframework.security.web.authentication.AuthenticationConverter;

Diff for: ‎config/src/test/kotlin/org/springframework/security/config/web/servlet/Saml2DslTests.kt

+1-1
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ import org.springframework.security.saml2.provider.service.registration.InMemory
4141
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration
4242
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository
4343
import org.springframework.security.saml2.provider.service.registration.TestRelyingPartyRegistrations
44-
import org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter
44+
import org.springframework.security.saml2.provider.service.web.authentication.Saml2WebSsoAuthenticationFilter
4545
import org.springframework.test.web.servlet.MockMvc
4646
import org.springframework.test.web.servlet.get
4747
import org.springframework.test.web.servlet.request.MockMvcRequestBuilders

Diff for: ‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/Saml2AuthenticationToken.java

+5-6
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
import org.springframework.security.authentication.AbstractAuthenticationToken;
2323
import org.springframework.security.saml2.credentials.Saml2X509Credential;
2424
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
25+
import org.springframework.security.saml2.provider.service.web.authentication.Saml2WebSsoAuthenticationFilter;
2526
import org.springframework.util.Assert;
2627

2728
/**
@@ -44,9 +45,8 @@ public class Saml2AuthenticationToken extends AbstractAuthenticationToken {
4445
* Creates a {@link Saml2AuthenticationToken} with the provided parameters.
4546
*
4647
* Note that the given {@link RelyingPartyRegistration} should have all its templates
47-
* resolved at this point. See
48-
* {@link org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter}
49-
* for an example of performing that resolution.
48+
* resolved at this point. See {@link Saml2WebSsoAuthenticationFilter} for an example
49+
* of performing that resolution.
5050
* @param relyingPartyRegistration the resolved {@link RelyingPartyRegistration} to
5151
* use
5252
* @param saml2Response the SAML 2.0 response to authenticate
@@ -68,9 +68,8 @@ public Saml2AuthenticationToken(RelyingPartyRegistration relyingPartyRegistratio
6868
* Creates a {@link Saml2AuthenticationToken} with the provided parameters
6969
*
7070
* Note that the given {@link RelyingPartyRegistration} should have all its templates
71-
* resolved at this point. See
72-
* {@link org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter}
73-
* for an example of performing that resolution.
71+
* resolved at this point. See {@link Saml2WebSsoAuthenticationFilter} for an example
72+
* of performing that resolution.
7473
* @param relyingPartyRegistration the resolved {@link RelyingPartyRegistration} to
7574
* use
7675
* @param saml2Response the SAML 2.0 response to authenticate

Diff for: ‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationFilter.java

+9-109
Original file line numberDiff line numberDiff line change
@@ -16,130 +16,30 @@
1616

1717
package org.springframework.security.saml2.provider.service.servlet.filter;
1818

19-
import javax.servlet.http.HttpServletRequest;
20-
import javax.servlet.http.HttpServletResponse;
21-
22-
import org.springframework.security.authentication.AbstractAuthenticationToken;
23-
import org.springframework.security.core.Authentication;
24-
import org.springframework.security.core.AuthenticationException;
25-
import org.springframework.security.saml2.core.Saml2Error;
26-
import org.springframework.security.saml2.core.Saml2ErrorCodes;
27-
import org.springframework.security.saml2.provider.service.authentication.AbstractSaml2AuthenticationRequest;
28-
import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationException;
2919
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
30-
import org.springframework.security.saml2.provider.service.web.DefaultRelyingPartyRegistrationResolver;
31-
import org.springframework.security.saml2.provider.service.web.HttpSessionSaml2AuthenticationRequestRepository;
32-
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationResolver;
33-
import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationRequestRepository;
34-
import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationTokenConverter;
35-
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
3620
import org.springframework.security.web.authentication.AuthenticationConverter;
37-
import org.springframework.security.web.authentication.session.ChangeSessionIdAuthenticationStrategy;
38-
import org.springframework.util.Assert;
3921

4022
/**
4123
* @since 5.2
24+
* @deprecated Use
25+
* {@link org.springframework.security.saml2.provider.service.web.authentication.Saml2WebSsoAuthenticationFilter}
26+
* instead
4227
*/
43-
public class Saml2WebSsoAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
44-
45-
public static final String DEFAULT_FILTER_PROCESSES_URI = "/login/saml2/sso/{registrationId}";
46-
47-
private final AuthenticationConverter authenticationConverter;
48-
49-
private Saml2AuthenticationRequestRepository<AbstractSaml2AuthenticationRequest> authenticationRequestRepository = new HttpSessionSaml2AuthenticationRequestRepository();
28+
@Deprecated
29+
public class Saml2WebSsoAuthenticationFilter
30+
extends org.springframework.security.saml2.provider.service.web.authentication.Saml2WebSsoAuthenticationFilter {
5031

51-
/**
52-
* Creates a {@code Saml2WebSsoAuthenticationFilter} authentication filter that is
53-
* configured to use the {@link #DEFAULT_FILTER_PROCESSES_URI} processing URL
54-
* @param relyingPartyRegistrationRepository - repository of configured SAML 2
55-
* entities. Required.
56-
*/
5732
public Saml2WebSsoAuthenticationFilter(RelyingPartyRegistrationRepository relyingPartyRegistrationRepository) {
58-
this(relyingPartyRegistrationRepository, DEFAULT_FILTER_PROCESSES_URI);
33+
super(relyingPartyRegistrationRepository);
5934
}
6035

61-
/**
62-
* Creates a {@code Saml2WebSsoAuthenticationFilter} authentication filter
63-
* @param relyingPartyRegistrationRepository - repository of configured SAML 2
64-
* entities. Required.
65-
* @param filterProcessesUrl the processing URL, must contain a {registrationId}
66-
* variable. Required.
67-
*/
6836
public Saml2WebSsoAuthenticationFilter(RelyingPartyRegistrationRepository relyingPartyRegistrationRepository,
6937
String filterProcessesUrl) {
70-
this(new Saml2AuthenticationTokenConverter(
71-
(RelyingPartyRegistrationResolver) new DefaultRelyingPartyRegistrationResolver(
72-
relyingPartyRegistrationRepository)),
73-
filterProcessesUrl);
74-
Assert.isTrue(filterProcessesUrl.contains("{registrationId}"),
75-
"filterProcessesUrl must contain a {registrationId} match variable");
38+
super(relyingPartyRegistrationRepository, filterProcessesUrl);
7639
}
7740

78-
/**
79-
* Creates a {@link Saml2WebSsoAuthenticationFilter} given the provided parameters
80-
* @param authenticationConverter the strategy for converting an
81-
* {@link HttpServletRequest} into an {@link Authentication}
82-
* @param filterProcessesUrl the processing URL
83-
* @since 5.4
84-
*/
8541
public Saml2WebSsoAuthenticationFilter(AuthenticationConverter authenticationConverter, String filterProcessesUrl) {
86-
super(filterProcessesUrl);
87-
Assert.notNull(authenticationConverter, "authenticationConverter cannot be null");
88-
Assert.hasText(filterProcessesUrl, "filterProcessesUrl must contain a URL pattern");
89-
this.authenticationConverter = authenticationConverter;
90-
setAllowSessionCreation(true);
91-
setSessionAuthenticationStrategy(new ChangeSessionIdAuthenticationStrategy());
92-
}
93-
94-
@Override
95-
protected boolean requiresAuthentication(HttpServletRequest request, HttpServletResponse response) {
96-
return super.requiresAuthentication(request, response);
97-
}
98-
99-
@Override
100-
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
101-
throws AuthenticationException {
102-
Authentication authentication = this.authenticationConverter.convert(request);
103-
if (authentication == null) {
104-
Saml2Error saml2Error = new Saml2Error(Saml2ErrorCodes.RELYING_PARTY_REGISTRATION_NOT_FOUND,
105-
"No relying party registration found");
106-
throw new Saml2AuthenticationException(saml2Error);
107-
}
108-
setDetails(request, authentication);
109-
this.authenticationRequestRepository.removeAuthenticationRequest(request, response);
110-
return getAuthenticationManager().authenticate(authentication);
111-
}
112-
113-
/**
114-
* Use the given {@link Saml2AuthenticationRequestRepository} to remove the saved
115-
* authentication request. If the {@link #authenticationConverter} is of the type
116-
* {@link Saml2AuthenticationTokenConverter}, the
117-
* {@link Saml2AuthenticationRequestRepository} will also be set into the
118-
* {@link #authenticationConverter}.
119-
* @param authenticationRequestRepository the
120-
* {@link Saml2AuthenticationRequestRepository} to use
121-
* @since 5.6
122-
*/
123-
public void setAuthenticationRequestRepository(
124-
Saml2AuthenticationRequestRepository<AbstractSaml2AuthenticationRequest> authenticationRequestRepository) {
125-
Assert.notNull(authenticationRequestRepository, "authenticationRequestRepository cannot be null");
126-
this.authenticationRequestRepository = authenticationRequestRepository;
127-
setAuthenticationRequestRepositoryIntoAuthenticationConverter(authenticationRequestRepository);
128-
}
129-
130-
private void setAuthenticationRequestRepositoryIntoAuthenticationConverter(
131-
Saml2AuthenticationRequestRepository<AbstractSaml2AuthenticationRequest> authenticationRequestRepository) {
132-
if (this.authenticationConverter instanceof Saml2AuthenticationTokenConverter) {
133-
Saml2AuthenticationTokenConverter authenticationTokenConverter = (Saml2AuthenticationTokenConverter) this.authenticationConverter;
134-
authenticationTokenConverter.setAuthenticationRequestRepository(authenticationRequestRepository);
135-
}
136-
}
137-
138-
private void setDetails(HttpServletRequest request, Authentication authentication) {
139-
if (AbstractAuthenticationToken.class.isAssignableFrom(authentication.getClass())) {
140-
Object details = this.authenticationDetailsSource.buildDetails(request);
141-
((AbstractAuthenticationToken) authentication).setDetails(details);
142-
}
42+
super(authenticationConverter, filterProcessesUrl);
14343
}
14444

14545
}

0 commit comments

Comments
 (0)