SAML2 customizable URLs

[JoakimLofgren]

Expected Behavior

I want to be able to change all SAML2 URLs to be able to e.g. add a prefix.

Current Behavior

Some URLs are customizable, like Saml2LoginConfigurer.loginProcessingUrl.
While some are not, e.g. Saml2LoginConfigurer.AuthenticationRequestEndpointConfig.filterProcessingUrl (/saml2/authenticate/{registrationId}).

Context

A workaround for adding a path prefix is using the server.servlet.context-path.
But this doesn't work if you want to tweak URLs to be similar to an already existing solution created with the old SAML module.

Although assuming you want /auth as a prefix, and after login you want to redirect to the root / and not /auth/,
you cannot use the default success handler. You need to create a custom one with a redirect strategy which is not context relative.

[jzheaux]

@JoakimLofgren I think it makes sense to simplify configuring the URL for creating an AuthnRequest.

If we follow the pattern established in OAuth2LoginConfigurer, I think most decisions will be fairly straightforward. For example, it would be nice to do:

http
    .saml2Login(saml2 -> saml2
        .authenticationRequestEndpoint(authn -> authn
            .baseUri(myCustomUri)
        )
    );

Then that would be quite similar to:

http
    .oauth2Login(oauth2 -> oauth2
        .authorizationEndpoint(authz -> authz
            .baseUri(myCustomUri)
        )
    );

Would you be able to submit a PR along those lines to enhance the DSL? It would also be quite nice to update the Kotlin DSL while you are at it.

[JoakimLofgren]

Sure. After #8864 is finished.

[jzheaux]

After a bit more experimentation with it, I think the following is easier to read:

http
    .saml2Login(saml2 -> saml2
        .loginProcessingUrl("/saml2/response/{registrationId}")
        .authenticationRequestUri("/saml2/request/{registrationId}")
    );

I like it because it has less hierarchy.

[jzheaux]

@JoakimLofgren are you still able to contribute a PR to add support for configuring the Saml2WebSsoAuthenticationRequestFilter URI?

[chelseakohli]

Hey, I am kind of stuck on being not able to change default entityId & replyUrl in AuthRequest. My SP is running on http, so the urls for entityId & replyUrl are being generated for http. But by making some firewall changes, publicly website access is only by https. So basically I want the urls in AuthRequest to be https.

[jzheaux]

@chelseakohli, this would probably be better as a StackOverflow question, so please consider posting there if my answer here doesn't address your question and also update your comment with the StackOverflow link.

You can customize the AuthnRequest by configuring the OpenSamlAuthenticationRequestFactory:

@Bean 
Saml2AuthenticationRequestFactory authenticationRequestFactory() {
    OpenSamlAuthenticationRequestFactory factory =
            new OpenSamlAuthenticationRequestFactory();
    factory.setAuthenticationRequestContextConverter((context) -> {
        // construct the AuthnRequest
    });
}