Skip to content

Commit 4df12a0

Browse files
Remove OpenSAML3 support
Closes spring-projectsgh-10556
1 parent 567c091 commit 4df12a0

File tree

20 files changed

+19
-2190
lines changed

20 files changed

+19
-2190
lines changed

Diff for: config/spring-security-config.gradle

-1
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,6 @@ dependencies {
4747
testImplementation project(path : ':spring-security-oauth2-client', configuration : 'tests')
4848
testImplementation project(path : ':spring-security-oauth2-resource-server', configuration : 'tests')
4949
testImplementation project(path : ':spring-security-saml2-service-provider', configuration : 'tests')
50-
testImplementation project(path : ':spring-security-saml2-service-provider', configuration : 'opensaml4MainImplementation')
5150
testImplementation project(path : ':spring-security-web', configuration : 'tests')
5251
testImplementation "jakarta.inject:jakarta.inject-api"
5352
testImplementation "org.assertj:assertj-core"

Diff for: config/src/main/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurer.java

+2-23
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,6 @@
1919
import java.util.LinkedHashMap;
2020
import java.util.Map;
2121

22-
import org.opensaml.core.Version;
23-
2422
import org.springframework.beans.factory.NoSuchBeanDefinitionException;
2523
import org.springframework.context.ApplicationContext;
2624
import org.springframework.security.authentication.AuthenticationManager;
@@ -33,7 +31,6 @@
3331
import org.springframework.security.core.Authentication;
3432
import org.springframework.security.saml2.provider.service.authentication.AbstractSaml2AuthenticationRequest;
3533
import org.springframework.security.saml2.provider.service.authentication.OpenSaml4AuthenticationProvider;
36-
import org.springframework.security.saml2.provider.service.authentication.OpenSamlAuthenticationProvider;
3734
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
3835
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
3936
import org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter;
@@ -43,7 +40,6 @@
4340
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationResolver;
4441
import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationRequestRepository;
4542
import org.springframework.security.saml2.provider.service.web.Saml2AuthenticationTokenConverter;
46-
import org.springframework.security.saml2.provider.service.web.authentication.OpenSaml3AuthenticationRequestResolver;
4743
import org.springframework.security.saml2.provider.service.web.authentication.OpenSaml4AuthenticationRequestResolver;
4844
import org.springframework.security.saml2.provider.service.web.authentication.Saml2AuthenticationRequestResolver;
4945
import org.springframework.security.web.authentication.AuthenticationConverter;
@@ -306,10 +302,7 @@ private Saml2AuthenticationRequestResolver getAuthenticationRequestResolver(B ht
306302
if (bean != null) {
307303
return bean;
308304
}
309-
if (version().startsWith("4")) {
310-
return new OpenSaml4AuthenticationRequestResolver(relyingPartyRegistrationResolver(http));
311-
}
312-
return new OpenSaml3AuthenticationRequestResolver(relyingPartyRegistrationResolver(http));
305+
return new OpenSaml4AuthenticationRequestResolver(relyingPartyRegistrationResolver(http));
313306
}
314307

315308
private AuthenticationConverter getAuthenticationConverter(B http) {
@@ -327,22 +320,8 @@ private AuthenticationConverter getAuthenticationConverter(B http) {
327320
return authenticationConverterBean;
328321
}
329322

330-
private String version() {
331-
String version = Version.getVersion();
332-
if (version != null) {
333-
return version;
334-
}
335-
return Version.class.getModule().getDescriptor().version().map(Object::toString)
336-
.orElseThrow(() -> new IllegalStateException("cannot determine OpenSAML version"));
337-
}
338-
339323
private void registerDefaultAuthenticationProvider(B http) {
340-
if (version().startsWith("4")) {
341-
http.authenticationProvider(postProcess(new OpenSaml4AuthenticationProvider()));
342-
}
343-
else {
344-
http.authenticationProvider(postProcess(new OpenSamlAuthenticationProvider()));
345-
}
324+
http.authenticationProvider(postProcess(new OpenSaml4AuthenticationProvider()));
346325
}
347326

348327
private void registerDefaultCsrfOverride(B http) {

Diff for: config/src/main/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LogoutConfigurer.java

+2-20
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@
2323

2424
import jakarta.servlet.http.HttpServletRequest;
2525
import jakarta.servlet.http.HttpServletResponse;
26-
import org.opensaml.core.Version;
2726

2827
import org.springframework.context.ApplicationContext;
2928
import org.springframework.security.authentication.AuthenticationManager;
@@ -44,8 +43,6 @@
4443
import org.springframework.security.saml2.provider.service.web.DefaultRelyingPartyRegistrationResolver;
4544
import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationResolver;
4645
import org.springframework.security.saml2.provider.service.web.authentication.logout.HttpSessionLogoutRequestRepository;
47-
import org.springframework.security.saml2.provider.service.web.authentication.logout.OpenSaml3LogoutRequestResolver;
48-
import org.springframework.security.saml2.provider.service.web.authentication.logout.OpenSaml3LogoutResponseResolver;
4946
import org.springframework.security.saml2.provider.service.web.authentication.logout.OpenSaml4LogoutRequestResolver;
5047
import org.springframework.security.saml2.provider.service.web.authentication.logout.OpenSaml4LogoutResponseResolver;
5148
import org.springframework.security.saml2.provider.service.web.authentication.logout.Saml2LogoutRequestFilter;
@@ -313,15 +310,6 @@ private <C> C getBeanOrNull(Class<C> clazz) {
313310
return this.context.getBean(clazz);
314311
}
315312

316-
private String version() {
317-
String version = Version.getVersion();
318-
if (version != null) {
319-
return version;
320-
}
321-
return Version.class.getModule().getDescriptor().version().map(Object::toString)
322-
.orElseThrow(() -> new IllegalStateException("cannot determine OpenSAML version"));
323-
}
324-
325313
/**
326314
* A configurer for SAML 2.0 LogoutRequest components
327315
*/
@@ -401,10 +389,7 @@ private Saml2LogoutRequestResolver logoutRequestResolver(
401389
if (this.logoutRequestResolver != null) {
402390
return this.logoutRequestResolver;
403391
}
404-
if (version().startsWith("4")) {
405-
return new OpenSaml4LogoutRequestResolver(relyingPartyRegistrationResolver);
406-
}
407-
return new OpenSaml3LogoutRequestResolver(relyingPartyRegistrationResolver);
392+
return new OpenSaml4LogoutRequestResolver(relyingPartyRegistrationResolver);
408393
}
409394

410395
}
@@ -471,10 +456,7 @@ private Saml2LogoutResponseValidator logoutResponseValidator() {
471456
private Saml2LogoutResponseResolver logoutResponseResolver(
472457
RelyingPartyRegistrationResolver relyingPartyRegistrationResolver) {
473458
if (this.logoutResponseResolver == null) {
474-
if (version().startsWith("4")) {
475-
return new OpenSaml4LogoutResponseResolver(relyingPartyRegistrationResolver);
476-
}
477-
return new OpenSaml3LogoutResponseResolver(relyingPartyRegistrationResolver);
459+
return new OpenSaml4LogoutResponseResolver(relyingPartyRegistrationResolver);
478460
}
479461
return this.logoutResponseResolver;
480462
}

Diff for: config/src/test/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurerTests.java

+5-20
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,7 @@
1818

1919
import java.io.IOException;
2020
import java.net.URLDecoder;
21-
import java.time.Duration;
2221
import java.util.Base64;
23-
import java.util.Collection;
2422
import java.util.Collections;
2523

2624
import jakarta.servlet.ServletException;
@@ -32,14 +30,12 @@
3230
import org.junit.jupiter.api.Test;
3331
import org.junit.jupiter.api.extension.ExtendWith;
3432
import org.mockito.ArgumentCaptor;
35-
import org.opensaml.saml.saml2.core.Assertion;
3633

3734
import org.springframework.beans.factory.BeanCreationException;
3835
import org.springframework.beans.factory.annotation.Autowired;
3936
import org.springframework.context.ConfigurableApplicationContext;
4037
import org.springframework.context.annotation.Bean;
4138
import org.springframework.context.annotation.Import;
42-
import org.springframework.core.convert.converter.Converter;
4339
import org.springframework.mock.web.MockFilterChain;
4440
import org.springframework.mock.web.MockHttpServletRequest;
4541
import org.springframework.mock.web.MockHttpServletResponse;
@@ -57,16 +53,13 @@
5753
import org.springframework.security.config.test.SpringTestContextExtension;
5854
import org.springframework.security.core.Authentication;
5955
import org.springframework.security.core.AuthenticationException;
60-
import org.springframework.security.core.GrantedAuthority;
6156
import org.springframework.security.core.annotation.AuthenticationPrincipal;
6257
import org.springframework.security.core.authority.SimpleGrantedAuthority;
63-
import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
6458
import org.springframework.security.saml2.core.Saml2ErrorCodes;
6559
import org.springframework.security.saml2.core.Saml2Utils;
6660
import org.springframework.security.saml2.core.TestSaml2X509Credentials;
6761
import org.springframework.security.saml2.provider.service.authentication.AbstractSaml2AuthenticationRequest;
6862
import org.springframework.security.saml2.provider.service.authentication.OpenSaml4AuthenticationProvider;
69-
import org.springframework.security.saml2.provider.service.authentication.OpenSamlAuthenticationProvider;
7063
import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticatedPrincipal;
7164
import org.springframework.security.saml2.provider.service.authentication.Saml2Authentication;
7265
import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationException;
@@ -118,14 +111,6 @@
118111
@ExtendWith(SpringTestContextExtension.class)
119112
public class Saml2LoginConfigurerTests {
120113

121-
private static final Converter<Assertion, Collection<? extends GrantedAuthority>> AUTHORITIES_EXTRACTOR = (
122-
a) -> Collections.singletonList(new SimpleGrantedAuthority("TEST"));
123-
124-
private static final GrantedAuthoritiesMapper AUTHORITIES_MAPPER = (authorities) -> Collections
125-
.singletonList(new SimpleGrantedAuthority("TEST CONVERTED"));
126-
127-
private static final Duration RESPONSE_TIME_VALIDATION_SKEW = Duration.ZERO;
128-
129114
private static final String SIGNED_RESPONSE = "PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbDJwOlJlc3BvbnNlIHhtbG5zOnNhbWwycD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiBEZXN0aW5hdGlvbj0iaHR0cHM6Ly9ycC5leGFtcGxlLm9yZy9hY3MiIElEPSJfYzE3MzM2YTAtNTM1My00MTQ5LWI3MmMtMDNkOWY5YWYzMDdlIiBJc3N1ZUluc3RhbnQ9IjIwMjAtMDgtMDRUMjI6MDQ6NDUuMDE2WiIgVmVyc2lvbj0iMi4wIj48c2FtbDI6SXNzdWVyIHhtbG5zOnNhbWwyPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj5hcC1lbnRpdHktaWQ8L3NhbWwyOklzc3Vlcj48ZHM6U2lnbmF0dXJlIHhtbG5zOmRzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIj4KPGRzOlNpZ25lZEluZm8+CjxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+CjxkczpTaWduYXR1cmVNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGRzaWctbW9yZSNyc2Etc2hhMjU2Ii8+CjxkczpSZWZlcmVuY2UgVVJJPSIjX2MxNzMzNmEwLTUzNTMtNDE0OS1iNzJjLTAzZDlmOWFmMzA3ZSI+CjxkczpUcmFuc2Zvcm1zPgo8ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI2VudmVsb3BlZC1zaWduYXR1cmUiLz4KPGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPgo8L2RzOlRyYW5zZm9ybXM+CjxkczpEaWdlc3RNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyNzaGEyNTYiLz4KPGRzOkRpZ2VzdFZhbHVlPjYzTmlyenFzaDVVa0h1a3NuRWUrM0hWWU5aYWFsQW1OQXFMc1lGMlRuRDA9PC9kczpEaWdlc3RWYWx1ZT4KPC9kczpSZWZlcmVuY2U+CjwvZHM6U2lnbmVkSW5mbz4KPGRzOlNpZ25hdHVyZVZhbHVlPgpLMVlvWWJVUjBTclY4RTdVMkhxTTIvZUNTOTNoV25mOExnNnozeGZWMUlyalgzSXhWYkNvMVlYcnRBSGRwRVdvYTJKKzVOMmFNbFBHJiMxMzsKN2VpbDBZRC9xdUVRamRYbTNwQTBjZmEvY25pa2RuKzVhbnM0ZWQwanU1amo2dkpvZ2w2Smt4Q25LWUpwTU9HNzhtampmb0phengrWCYjMTM7CkM2NktQVStBYUdxeGVwUEQ1ZlhRdTFKSy9Jb3lBaitaa3k4Z2Jwc3VyZHFCSEJLRWxjdnVOWS92UGY0OGtBeFZBKzdtRGhNNUMvL1AmIzEzOwp0L084Y3NZYXB2UjZjdjZrdk45QXZ1N3FRdm9qVk1McHVxZWNJZDJwTUVYb0NSSnE2Nkd4MStNTUVPeHVpMWZZQlRoMEhhYjRmK3JyJiMxMzsKOEY2V1NFRC8xZllVeHliRkJqZ1Q4d2lEWHFBRU8wSVY4ZWRQeEE9PQo8L2RzOlNpZ25hdHVyZVZhbHVlPgo8L2RzOlNpZ25hdHVyZT48c2FtbDI6QXNzZXJ0aW9uIHhtbG5zOnNhbWwyPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIiBJRD0iQWUzZjQ5OGI4LTliMTctNDA3OC05ZDM1LTg2YTA4NDA4NDk5NSIgSXNzdWVJbnN0YW50PSIyMDIwLTA4LTA0VDIyOjA0OjQ1LjA3N1oiIFZlcnNpb249IjIuMCI+PHNhbWwyOklzc3Vlcj5hcC1lbnRpdHktaWQ8L3NhbWwyOklzc3Vlcj48c2FtbDI6U3ViamVjdD48c2FtbDI6TmFtZUlEPnRlc3RAc2FtbC51c2VyPC9zYW1sMjpOYW1lSUQ+PHNhbWwyOlN1YmplY3RDb25maXJtYXRpb24gTWV0aG9kPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6Y206YmVhcmVyIj48c2FtbDI6U3ViamVjdENvbmZpcm1hdGlvbkRhdGEgTm90QmVmb3JlPSIyMDIwLTA4LTA0VDIxOjU5OjQ1LjA5MFoiIE5vdE9uT3JBZnRlcj0iMjA0MC0wNy0zMFQyMjowNTowNi4wODhaIiBSZWNpcGllbnQ9Imh0dHBzOi8vcnAuZXhhbXBsZS5vcmcvYWNzIi8+PC9zYW1sMjpTdWJqZWN0Q29uZmlybWF0aW9uPjwvc2FtbDI6U3ViamVjdD48c2FtbDI6Q29uZGl0aW9ucyBOb3RCZWZvcmU9IjIwMjAtMDgtMDRUMjE6NTk6NDUuMDgwWiIgTm90T25PckFmdGVyPSIyMDQwLTA3LTMwVDIyOjA1OjA2LjA4N1oiLz48L3NhbWwyOkFzc2VydGlvbj48L3NhbWwycDpSZXNwb25zZT4=";
130115

131116
private static final AuthenticationConverter AUTHENTICATION_CONVERTER = mock(AuthenticationConverter.class);
@@ -437,12 +422,12 @@ static class Saml2LoginConfigWithAuthenticationDefaultsWithPostProcessor extends
437422

438423
@Override
439424
protected void configure(HttpSecurity http) throws Exception {
440-
ObjectPostProcessor<OpenSamlAuthenticationProvider> processor = new ObjectPostProcessor<OpenSamlAuthenticationProvider>() {
425+
ObjectPostProcessor<OpenSaml4AuthenticationProvider> processor = new ObjectPostProcessor<>() {
441426
@Override
442-
public <O extends OpenSamlAuthenticationProvider> O postProcess(O provider) {
443-
provider.setResponseTimeValidationSkew(RESPONSE_TIME_VALIDATION_SKEW);
444-
provider.setAuthoritiesMapper(AUTHORITIES_MAPPER);
445-
provider.setAuthoritiesExtractor(AUTHORITIES_EXTRACTOR);
427+
public <O extends OpenSaml4AuthenticationProvider> O postProcess(O provider) {
428+
provider.setResponseValidator(OpenSaml4AuthenticationProvider.createDefaultResponseValidator());
429+
provider.setResponseAuthenticationConverter(
430+
OpenSaml4AuthenticationProvider.createDefaultResponseAuthenticationConverter());
446431
return provider;
447432
}
448433
};
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,4 @@
11
apply plugin: 'io.spring.convention.spring-module'
2-
apply plugin: 'nebula.facet'
3-
4-
facets {
5-
opensaml3Main {
6-
parentSourceSet = 'main'
7-
}
8-
opensaml4Main {
9-
parentSourceSet = 'main'
10-
}
11-
opensaml3Test {
12-
parentSourceSet = 'opensaml3Main'
13-
}
14-
opensaml4Test {
15-
parentSourceSet = 'opensaml4Main'
16-
}
17-
}
18-
19-
sourceSets {
20-
opensaml3Test {
21-
compileClasspath += sourceSets.test.output
22-
runtimeClasspath += sourceSets.test.output
23-
}
24-
opensaml4Test {
25-
compileClasspath += sourceSets.test.output
26-
runtimeClasspath += sourceSets.test.output
27-
}
28-
}
29-
30-
configurations {
31-
opensaml3TestImplementation.extendsFrom testImplementation
32-
opensaml4TestImplementation.extendsFrom testImplementation
33-
opensaml4MainImplementation {
34-
canBeConsumed = true
35-
}
36-
}
37-
38-
compileOpensaml4MainJava {
39-
sourceCompatibility = JavaVersion.VERSION_17
40-
targetCompatibility = JavaVersion.VERSION_17
41-
}
422

433
dependencies {
444
management platform(project(":spring-security-dependencies"))
@@ -50,11 +10,11 @@ dependencies {
5010
api ("org.opensaml:opensaml-saml-impl") {
5111
exclude group: 'commons-logging', module: 'commons-logging'
5212
}
53-
opensaml4MainImplementation "org.opensaml:opensaml-core:4.1.0"
54-
opensaml4MainImplementation ("org.opensaml:opensaml-saml-api:4.1.0") {
13+
implementation "org.opensaml:opensaml-core:4.1.0"
14+
implementation ("org.opensaml:opensaml-saml-api:4.1.0") {
5515
exclude group: 'commons-logging', module: 'commons-logging'
5616
}
57-
opensaml4MainImplementation ("org.opensaml:opensaml-saml-impl:4.1.0") {
17+
implementation ("org.opensaml:opensaml-saml-impl:4.1.0") {
5818
exclude group: 'commons-logging', module: 'commons-logging'
5919
}
6020

@@ -73,35 +33,3 @@ dependencies {
7333
testImplementation "org.mockito:mockito-junit-jupiter"
7434
testImplementation "org.springframework:spring-test"
7535
}
76-
77-
project.tasks.matching { t -> t.name == "jar"}.configureEach {
78-
duplicatesStrategy = DuplicatesStrategy.EXCLUDE
79-
from {
80-
compileOpensaml3MainJava
81-
}
82-
from {
83-
compileOpensaml4MainJava
84-
}
85-
}
86-
87-
project.tasks.matching { t -> t.name == "sourcesJar"}.configureEach {
88-
from {
89-
sourceSets.opensaml3Main.allSource
90-
}
91-
from {
92-
sourceSets.opensaml4Main.allSource
93-
}
94-
}
95-
96-
97-
javadoc {
98-
source += sourceSets.opensaml3Main.allJava + sourceSets.opensaml4Main.allJava
99-
}
100-
101-
opensaml3Test {
102-
useJUnitPlatform()
103-
}
104-
105-
opensaml4Test {
106-
useJUnitPlatform()
107-
}
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2021 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2021 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

0 commit comments

Comments
 (0)