Skip to content

Commit 21c0b79

Browse files
mhalbrittermhalbritter
committed
Rename 'identityprovider' property to 'asserting-party'
Rename spring.security.saml2.relyingparty.registration.*.identity-provider.* to spring.security.saml2.relyingparty.registration.*.asserting-party.* The old property names are still supported, but will lead to a warning in the logs. Closes spring-projectsgh-30642
1 parent 29f83fa commit 21c0b79

File tree

8 files changed

+308
-79
lines changed

8 files changed

+308
-79
lines changed

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfigurationTests.java

+15-2
Original file line numberDiff line numberDiff line change
@@ -136,8 +136,21 @@ void backOffIfOAuth2ResourceServerAutoConfigurationPresent() {
136136
void backOffIfSaml2RelyingPartyAutoConfigurationPresent() {
137137
this.contextRunner.withConfiguration(AutoConfigurations.of(Saml2RelyingPartyAutoConfiguration.class))
138138
.withPropertyValues(
139-
"spring.security.saml2.relyingparty.registration.simplesamlphp.identity-provider.single-sign-on.url=https://simplesaml-for-spring-saml/SSOService.php",
140-
"spring.security.saml2.relyingparty.registration.simplesamlphp.identity-provider.single-sign-on.sign-request=false",
139+
"spring.security.saml2.relyingparty.registration.simplesamlphp.asserting-party.single-sign-on.url=https://simplesaml-for-spring-saml/SSOService.php",
140+
"spring.security.saml2.relyingparty.registration.simplesamlphp.asserting-party.single-sign-on.sign-request=false",
141+
"spring.security.saml2.relyingparty.registration.simplesamlphp.asserting-party.entity-id=https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/metadata.php",
142+
"spring.security.saml2.relyingparty.registration.simplesamlphp.asserting-party.verification.credentials[0].certificate-location=classpath:saml/certificate-location")
143+
.run((context) -> assertThat(context).doesNotHaveBean(ManagementWebSecurityAutoConfiguration.class)
144+
.doesNotHaveBean(MANAGEMENT_SECURITY_FILTER_CHAIN_BEAN));
145+
}
146+
147+
@Test
148+
@Deprecated
149+
void backOffIfSaml2RelyingPartyAutoConfigurationPresentDeprecated() {
150+
this.contextRunner.withConfiguration(AutoConfigurations.of(Saml2RelyingPartyAutoConfiguration.class))
151+
.withPropertyValues(
152+
"spring.security.saml2.relyingparty.registration.simplesamlphp.identityprovider.single-sign-on.url=https://simplesaml-for-spring-saml/SSOService.php",
153+
"spring.security.saml2.relyingparty.registration.simplesamlphp.identityprovider.single-sign-on.sign-request=false",
141154
"spring.security.saml2.relyingparty.registration.simplesamlphp.identityprovider.entity-id=https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/metadata.php",
142155
"spring.security.saml2.relyingparty.registration.simplesamlphp.identityprovider.verification.credentials[0].certificate-location=classpath:saml/certificate-location")
143156
.run((context) -> assertThat(context).doesNotHaveBean(ManagementWebSecurityAutoConfiguration.class)

‎spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/saml2/Saml2RelyingPartyProperties.java

+27-6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2021 the original author or authors.
2+
* Copyright 2012-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -67,7 +67,14 @@ public static class Registration {
6767
/**
6868
* Remote SAML Identity Provider.
6969
*/
70-
private final Identityprovider identityprovider = new Identityprovider();
70+
private final AssertingParty assertingParty = new AssertingParty();
71+
72+
/**
73+
* Remote SAML Identity Provider.
74+
* @deprecated use {@link #assertingParty}
75+
*/
76+
@Deprecated
77+
private final AssertingParty identityprovider = new AssertingParty();
7178

7279
public String getEntityId() {
7380
return this.entityId;
@@ -89,7 +96,17 @@ public Decryption getDecryption() {
8996
return this.decryption;
9097
}
9198

92-
public Identityprovider getIdentityprovider() {
99+
public AssertingParty getAssertingParty() {
100+
return this.assertingParty;
101+
}
102+
103+
/**
104+
* Remote SAML Identity Provider.
105+
* @return remote SAML Identity Provider
106+
* @deprecated use {@link #getAssertingParty()}
107+
*/
108+
@Deprecated
109+
public AssertingParty getIdentityprovider() {
93110
return this.identityprovider;
94111
}
95112

@@ -224,7 +241,7 @@ public void setCertificateLocation(Resource certificate) {
224241
/**
225242
* Represents a remote Identity Provider.
226243
*/
227-
public static class Identityprovider {
244+
public static class AssertingParty {
228245

229246
/**
230247
* Unique identifier for the identity provider.
@@ -282,7 +299,7 @@ public static class Singlesignon {
282299
/**
283300
* Whether to sign authentication requests.
284301
*/
285-
private boolean signRequest = true;
302+
private Boolean signRequest;
286303

287304
public String getUrl() {
288305
return this.url;
@@ -304,7 +321,11 @@ public boolean isSignRequest() {
304321
return this.signRequest;
305322
}
306323

307-
public void setSignRequest(boolean signRequest) {
324+
public Boolean getSignRequest() {
325+
return this.signRequest;
326+
}
327+
328+
public void setSignRequest(Boolean signRequest) {
308329
this.signRequest = signRequest;
309330
}
310331

‎spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/saml2/Saml2RelyingPartyRegistrationConfiguration.java

+43-15
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2021 the original author or authors.
2+
* Copyright 2012-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -23,11 +23,16 @@
2323
import java.util.List;
2424
import java.util.Map;
2525
import java.util.function.Consumer;
26+
import java.util.function.Function;
2627
import java.util.stream.Collectors;
2728

29+
import org.apache.commons.logging.Log;
30+
import org.apache.commons.logging.LogFactory;
31+
2832
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
33+
import org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyProperties.AssertingParty;
34+
import org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyProperties.AssertingParty.Verification;
2935
import org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyProperties.Decryption;
30-
import org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyProperties.Identityprovider.Verification;
3136
import org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyProperties.Registration;
3237
import org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyProperties.Registration.Signing;
3338
import org.springframework.boot.context.properties.PropertyMapper;
@@ -59,6 +64,8 @@
5964
@ConditionalOnMissingBean(RelyingPartyRegistrationRepository.class)
6065
class Saml2RelyingPartyRegistrationConfiguration {
6166

67+
private static final Log logger = LogFactory.getLog(Saml2RelyingPartyRegistrationConfiguration.class);
68+
6269
@Bean
6370
RelyingPartyRegistrationRepository relyingPartyRegistrationRepository(Saml2RelyingPartyProperties properties) {
6471
List<RelyingPartyRegistration> registrations = properties.getRegistration().entrySet().stream()
@@ -71,19 +78,21 @@ private RelyingPartyRegistration asRegistration(Map.Entry<String, Registration>
7178
}
7279

7380
private RelyingPartyRegistration asRegistration(String id, Registration properties) {
74-
boolean usingMetadata = StringUtils.hasText(properties.getIdentityprovider().getMetadataUri());
81+
boolean usingMetadata = StringUtils
82+
.hasText(getFromAssertingParty(properties, id, "metadata-uri", AssertingParty::getMetadataUri));
7583
Builder builder = (usingMetadata) ? RelyingPartyRegistrations
76-
.fromMetadataLocation(properties.getIdentityprovider().getMetadataUri()).registrationId(id)
77-
: RelyingPartyRegistration.withRegistrationId(id);
84+
.fromMetadataLocation(
85+
getFromAssertingParty(properties, id, "metadata-uri", AssertingParty::getMetadataUri))
86+
.registrationId(id) : RelyingPartyRegistration.withRegistrationId(id);
7887
builder.assertionConsumerServiceLocation(properties.getAcs().getLocation());
7988
builder.assertionConsumerServiceBinding(properties.getAcs().getBinding());
80-
builder.assertingPartyDetails(mapIdentityProvider(properties, usingMetadata));
89+
builder.assertingPartyDetails(mapAssertingParty(properties, id, usingMetadata));
8190
builder.signingX509Credentials((credentials) -> properties.getSigning().getCredentials().stream()
8291
.map(this::asSigningCredential).forEach(credentials::add));
8392
builder.decryptionX509Credentials((credentials) -> properties.getDecryption().getCredentials().stream()
8493
.map(this::asDecryptionCredential).forEach(credentials::add));
85-
builder.assertingPartyDetails((details) -> details
86-
.verificationX509Credentials((credentials) -> properties.getIdentityprovider().getVerification()
94+
builder.assertingPartyDetails((details) -> details.verificationX509Credentials(
95+
(credentials) -> getFromAssertingParty(properties, id, "verification", AssertingParty::getVerification)
8796
.getCredentials().stream().map(this::asVerificationCredential).forEach(credentials::add)));
8897
builder.entityId(properties.getEntityId());
8998
RelyingPartyRegistration registration = builder.build();
@@ -92,16 +101,35 @@ private RelyingPartyRegistration asRegistration(String id, Registration properti
92101
return registration;
93102
}
94103

95-
private Consumer<AssertingPartyDetails.Builder> mapIdentityProvider(Registration properties,
104+
@SuppressWarnings("deprecation")
105+
private <T> T getFromAssertingParty(Registration registration, String id, String name,
106+
Function<AssertingParty, T> getter) {
107+
T newValue = getter.apply(registration.getAssertingParty());
108+
if (newValue != null) {
109+
return newValue;
110+
}
111+
T deprecatedValue = getter.apply(registration.getIdentityprovider());
112+
if (deprecatedValue != null) {
113+
logger.warn(String.format(
114+
"Property 'spring.security.saml2.relyingparty.registration.identityprovider.%1$s.%2$s' is deprecated, please use 'spring.security.saml2.relyingparty.registration.asserting-party.%1$s.%2$s' instead",
115+
id, name));
116+
return deprecatedValue;
117+
}
118+
return newValue;
119+
}
120+
121+
private Consumer<AssertingPartyDetails.Builder> mapAssertingParty(Registration registration, String id,
96122
boolean usingMetadata) {
97123
PropertyMapper map = PropertyMapper.get().alwaysApplyingWhenNonNull();
98-
Saml2RelyingPartyProperties.Identityprovider identityprovider = properties.getIdentityprovider();
99124
return (details) -> {
100-
map.from(identityprovider::getEntityId).to(details::entityId);
101-
map.from(identityprovider.getSinglesignon()::getBinding).whenNonNull()
102-
.to(details::singleSignOnServiceBinding);
103-
map.from(identityprovider.getSinglesignon()::getUrl).to(details::singleSignOnServiceLocation);
104-
map.from(identityprovider.getSinglesignon()::isSignRequest).when((signRequest) -> !usingMetadata)
125+
map.from(() -> getFromAssertingParty(registration, id, "entity-id", AssertingParty::getEntityId))
126+
.to(details::entityId);
127+
map.from(() -> getFromAssertingParty(registration, id, "singlesignon.binding",
128+
(property) -> property.getSinglesignon().getBinding())).to(details::singleSignOnServiceBinding);
129+
map.from(() -> getFromAssertingParty(registration, id, "singlesignon.url",
130+
(property) -> property.getSinglesignon().getUrl())).to(details::singleSignOnServiceLocation);
131+
map.from(() -> getFromAssertingParty(registration, id, "singlesignon.sign-request",
132+
(property) -> property.getSinglesignon().getSignRequest())).when((ignored) -> !usingMetadata)
105133
.to(details::wantAuthnRequestsSigned);
106134
};
107135
}

0 commit comments

Comments
 (0)