Git Product home page Git Product logo

Comments (3)

spring-projects-issues avatar spring-projects-issues commented on July 29, 2024

Aslak Knutsen said:

I've created this patch to be able to add GrantedAuthorities on the AuthenticationToken.

It basicly adds a new extension point right before the AuthenticationToken creation.

public interface SAMLUserAuthorityService {

    GrantedAuthority[] grant(SAMLCredential credential);

}

It also contains a implementation of SAMLUserAuthorityService that uses the Attributes in the AuthResponse to extract the GrantedAuthorities.

LDAPAttributeValueExtractor is added as a example of a extractor based on SAML backed by LDAP.

    <!-- SAML Authentication Provider responsible for validating of received SAML messages -->
    <bean id="samlAuthenticationProvider" class="org.springframework.security.saml.SAMLAuthenticationProvider">
        <constructor-arg index="0" ref="webSSOprofileConsumber" />
        <security:custom-authentication-provider />
        <!-- OPTIONAL property: can be used to store/load user data after login
        <property name="userDetails" ref="attributeUserDetailsService" />
         -->
        <!-- OPTIONAL property: can be used to load/extract user authorities before login -->
        <property name="userAuthority" ref="samlUserAuthorityService" />
    </bean>

    <!-- Service for extracting GrantedAuthorities from the AuthnResponse -->
    <bean id="samlUserAuthorityService" class="org.springframework.security.saml.authority.SAMLAuthRequestAttributeAuthorityService">
        <!-- the name of the attribute in the AuthResponse to extract -->
        <property name="attributeName" value="memberOf" />
        <!-- used to extract the value from the XMLObject in the AuthResponse -->
        <property name="attributeValueExtractor" ref="samlUserAthorityAttributeExtractor" />
    </bean>

    <!-- Special attribute statement value mapper/converter, cn=xx,.. -> ROLE_XX -->
    <bean id="samlUserAthorityAttributeExtractor" class="org.springframework.security.saml.authority.LDAPAttributeValueExtractor" />

from spring-security-saml.

spring-projects-issues avatar spring-projects-issues commented on July 29, 2024

Mandus Elfving said:

Attached is a patch to make any attributes sent with the assertion available in the SAMLCredential and the security context.

from spring-security-saml.

spring-projects-issues avatar spring-projects-issues commented on July 29, 2024

Vladimir Schäfer said:

Attributes are populated as part of the WebSSOProfileConsumer call into a SAMLCredential object.

User supplied custom implementation of the SAMLUserDetailsService is responsible for parsing the SAMLCredential and creating object implementing UserDetails interface. GrantedAuthorities returned from the UserDetails#getAuthorities call are also set to the Authentication object returned as part of the SSO process.

SAMLUserDetailsService can be set in the securityContext.xml (bean id samlAuthenticationProvider)

from spring-security-saml.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.