So erstellen Sie einen im Speicher Benutzer in SAML

Question

Hallo Ich benutze Spring Boot 1.4.0 + Feder-Sicherheit-SAML2-Core 1.0.2 mit Hilfe der folgenden Link Spring-Boot-Saml-example es funktioniert gut. Jetzt möchte ich einen in Speicher Benutzer mit den gleichen erteilten Berechtigungen erstellen, die der SAML-Benutzer ausgegeben wird. Finden Sie den folgenden Code von SAMLUserDetailsServiceImpl als Referenz. Ihre Hilfe sollte spürbar sein.

@Service 
public class SAMLUserDetailsServiceImpl implements SAMLUserDetailsService { 

// Logger 
private static final Logger LOG = LoggerFactory.getLogger(SAMLUserDetailsServiceImpl.class); 

@Value("${emailSamlAttrName}") 
private String emailSamlAttrName; 

public Object loadUserBySAML(SAMLCredential credential) 
     throws UsernameNotFoundException { 

    // The method is supposed to identify local account of user referenced by 
    // data in the SAML assertion and return UserDetails object describing the user. 

    String userID = credential.getNameID().getValue(); 
    Attribute emailAttribute = credential.getAttribute(emailSamlAttrName); 
    String userEmail = getAttributeValue(credential.getAttribute(emailSamlAttrName).getAttributeValues().get(0)); 
    LOG.info(userID + " is logged in"); 
    List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>(); 
    GrantedAuthority authority = new SimpleGrantedAuthority("ROLE_USER"); 
    authorities.add(authority); 

    // In a real scenario, this implementation has to locate user in a arbitrary 
    // dataStore based on information present in the SAMLCredential and 
    // returns such a date in a form of application specific UserDetails object. 
    return new User(userID, "<abc123>", true, true, true, true, authorities); 
} 

Gemäß dem @ blur0224 Kommentar habe ich den folgenden Code in:

@Autowired 
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
     auth.inMemoryAuthentication().withUser("sample").password("sample123").roles("NONE"); 
     auth.inMemoryAuthentication().withUser("dummy").password("dummy123").roles("USER"); 
     auth.inMemoryAuthentication().withUser("proxy").password("proxy123").roles("USER"); 
} 

Aber es führt den folgenden Fehler ....

11:09:41.345 [http-nio-8040-exec-1] DEBUG o.s.s.w.a.i.FilterSecurityInterceptor [transactionId: ]- Secure object: FilterInvocation: URL: /api/v1/users/authenticated; Attributes: [hasRole('ROLE_NONE') or hasRole('ROLE_USER')] 
11:09:41.345 [http-nio-8040-exec-1] DEBUG o.s.s.w.a.i.FilterSecurityInterceptor [transactionId: ]- Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@9055c2b c: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS 
11:09:41.351 [http-nio-8040-exec-1] DEBUG o.s.s.access.vote.AffirmativeBased [transactionId: ]- Voter: org.springframework.security.web.access.expression.WebExpressionVoter@2809e0b9, returned: -1 
11:09:41.352 [http-nio-8040-exec-1] DEBUG o.s.b.f.s.DefaultListableBeanFactory [transactionId: ]- Returning cached instance of singleton bean 'delegatingApplicationListener' 
11:09:41.352 [http-nio-8040-exec-1] DEBUG o.s.b.f.s.DefaultListableBeanFactory [transactionId: ]- Returning cached instance of singleton bean 'authorizationAuditListener' 
11:09:41.354 [http-nio-8040-exec-1] DEBUG o.s.b.f.s.DefaultListableBeanFactory [transactionId: ]- Returning cached instance of singleton bean 'delegatingApplicationListener' 
11:09:41.354 [http-nio-8040-exec-1] DEBUG o.s.b.f.s.DefaultListableBeanFactory [transactionId: ]- Returning cached instance of singleton bean 'auditListener' 
11:09:41.354 [http-nio-8040-exec-1] DEBUG o.s.b.a.audit.listener.AuditListener [transactionId: ]- AuditEvent [timestamp=Wed Jul 27 11:09:41 CEST 2016, principal=anonymousUser, type=AUTHORIZATION_FAILURE, data={type=org.springframework.security.access.AccessDeniedException, message=Access is denied}] 
11:09:41.359 [http-nio-8040-exec-1] DEBUG o.s.s.w.a.ExceptionTranslationFilter [transactionId: ]- Access is denied (user is anonymous); redirecting to authentication entry point 
org.springframework.security.access.AccessDeniedException: Access is denied 
at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:83) 
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:232) 
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:123) 
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:90) 
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) 
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:114) 
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) 
at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:122) 
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) 
at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111) 
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) 
at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:169) 
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) 
at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:48) 
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) 
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:207) 
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:184) 
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) 
at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:158) 
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) 
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:120) 
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) 
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64) 
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) 
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:91) 
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) 
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:53) 
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) 
at org.springframework.security.saml.metadata.MetadataGeneratorFilter.doFilter(MetadataGeneratorFilter.java:87) 
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) 
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:213) 
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:176) 
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346) 
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262) 
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240) 
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207) 
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) 
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240) 
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207) 
at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:87) 
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240) 
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207) 
at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:77) 
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240) 
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207) 
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:121) 
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240) 
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207) 
at org.springframework.boot.actuate.autoconfigure.MetricsFilter.doFilterInternal(MetricsFilter.java:103) 
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240) 
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207) 
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:212) 
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106) 
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:502) 
at org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:676) 
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141) 
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) 
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) 
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:522) 
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1095) 
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:672) 
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1500) 
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1456) 
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) 
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) 
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) 
at java.lang.Thread.run(Thread.java:745) 

WebSecurityConfig.java

@Override 
protected void configure(HttpSecurity http) throws Exception { 
    http 
     .httpBasic() 
      .authenticationEntryPoint(samlEntryPoint()); 
    http 
     .csrf() 
      .disable(); 
    http 
     .addFilterBefore(metadataGeneratorFilter(), ChannelProcessingFilter.class) 
     .addFilterAfter(samlFilter(), BasicAuthenticationFilter.class); 
    http 
     .authorizeRequests() 
     .antMatchers("/error").permitAll() 
     .antMatchers("/saml/**").permitAll() 
     .antMatchers("/api/*/users/authenticated").access(String.format("hasRole('%s') or hasRole('%s')", ROLE_NONE, ROLE_USER)) 
     .antMatchers("/api/**").access(String.format("hasRole('%s')", ROLE_USER)) 
     .anyRequest().access(String.format("hasRole('%s')", ROLE_USER)); 
    http 
     .logout() 
      .logoutSuccessUrl("/"); 
} 

Answer 1

In Ihrer SAMLUserDetailsServiceImpl suchen Sie derzeit nicht den Benutzer in einer DB, um bestimmte Informationen über sie zu erhalten. Wenn dies der Fall ist, können Sie Ihre lokale Sicherheitskonfiguration so einrichten, dass Speicherbenutzer mit derselben erteilten Berechtigung erstellt werden, die sie beim Durchlaufen von SAML haben. ROLE_USER Sie können das folgende Beispiel als Anleitung zum Einrichten eines Benutzers verwenden, mit dem Sie sich wie bei Ihrer lokalen Entwicklung anmelden können.

Example of In Memory Users

Vermissen Sie das?

@Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http.authorizeRequests().antMatchers("/info/**").hasAnyRole("ADMIN","USER"). 
     and().formLogin(); 
    } 

Sie benötigen zwei separate Sicherheitskonfigurationen: WebSecurityConfig und LocalSecurityConfig Wenn lokal ausgeführt möchten, dass Sie die schnellste und einfachste Weg, um Ihre Implementierung von SAML zu replizieren, was mit Ihnen bietet, die ein Benutzer mit gewährt Behörden ist. Beachten Sie, dass Sie @Profile("dev","test","prod") auf SAML-Konfiguration haben müssen Dateien WebSecurityConfig

@Configuration 
@ComponentScan("com.whatever.etc") 
@EnableWebSecurity 
@Profile("local") 
public class SecurityConfig extends WebSecurityConfigurerAdapter { 
    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http.authorizeRequests().antMatchers("/**").hasAnyRole("ADMIN","USER"). 
     and().httpBasic(); 
    } 
    @Autowired 
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
      auth.inMemoryAuthentication().withUser("ram").password("ram123").roles("ADMIN"); 
      auth.inMemoryAuthentication().withUser("ravan").password("ravan123").roles("USER"); 
      auth.inMemoryAuthentication().withUser("kans").password("kans123").roles("USER"); 
    } 
} 

Sie können nicht einfach Benutzer in die SAML-Konfiguration hinzugefügt werden, da die ihm einen anderen Einstiegspunkt hat. Durch das Erstellen einer separaten Konfiguration können Sie genau steuern, wie sich die Anwendung nur lokal ausführen soll. Es ist auch möglich, aber nicht notwendig, die zwei Konfigurationen in einer einzigen Datei zu kombinieren. Ich würde empfehlen, sie zuerst separat arbeiten zu lassen.

Answer 2

können Sie diese Bibliothek verwenden: spring-boot-security-saml

dass neben hoch die Verwendung von federsicherheits saml Vereinfachung und Feder-boot es bereits einen In-Memory-SAMLUserDetails aus dem Kasten hat.

Sie könnten diese Klasse erweitern die gewährten Behörden zurückzukehren, von welcher SAML-Attribut von Ihrem IDP