5

When using pre-configured service provider metadata, in spring security, should there be 2 beans definitions for extended metadata delegate ? one for IDP metadata, and one for SP metadata ? 

<bean class="org.springframework.security.saml.metadata.ExtendedMetadataDelegate">
    <constructor-arg>
        <bean class="org.opensaml.saml2.metadata.provider.FilesystemMetadataProvider">
            <constructor-arg>
                <value type="java.io.File">classpath:security/localhost_sp.xml</value>
            </constructor-arg>
            <property name="parserPool" ref="parserPool"/>
        </bean>
    </constructor-arg>
    <constructor-arg>
        <bean class="org.springframework.security.saml.metadata.ExtendedMetadata">
           <property name="local" value="true"/>
           <property name="alias" value="default"/>
           <property name="securityProfile" value="metaiop"/>
           <property name="sslSecurityProfile" value="pkix"/>
           <property name="signingKey" value="apollo"/>
           <property name="encryptionKey" value="apollo"/>
           <property name="requireArtifactResolveSigned" value="false"/>
           <property name="requireLogoutRequestSigned" value="false"/>
           <property name="requireLogoutResponseSigned" value="false"/>
           <property name="idpDiscoveryEnabled" value="true"/>
           <property name="idpDiscoveryURL"
              value="https://www.server.com:8080/context/saml/discovery/alias/default"/>
           <property name="idpDiscoveryResponseURL"
              value="https://www.server.com:8080/context/saml/login/alias/default?disco=true"/>
        </bean>
    </constructor-arg>
</bean>




<bean class="org.springframework.security.saml.metadata.ExtendedMetadataDelegate">
    <constructor-arg>
        <bean class="org.opensaml.saml2.metadata.provider.FilesystemMetadataProvider">
            <constructor-arg>
                <value type="java.io.File">classpath:security/idp.xml</value>
            </constructor-arg>
            <property name="parserPool" ref="parserPool"/>
        </bean>
    </constructor-arg>
    <constructor-arg>
        <bean class="org.springframework.security.saml.metadata.ExtendedMetadata"/>
    </constructor-arg>
</bean>
Vladimír Schäfer
  • 15,375
  • 2
  • 51
  • 71
user3280968
  • 181
  • 1
  • 8

1 Answers1

11

Found the answer to my question....positing it here in case someone else looking for the same. 

     <bean id="metadata" class="org.springframework.security.saml.metadata.CachingMetadataManager">
        <constructor-arg>
            <list>

            <bean class="org.springframework.security.saml.metadata.ExtendedMetadataDelegate">
                <constructor-arg>
                    <bean class="org.opensaml.saml2.metadata.provider.HTTPMetadataProvider">
                        <constructor-arg>

                        <value type="java.lang.String">http://idp.ssocircle.com/idp-meta.xml</value>

                        </constructor-arg>
                        <constructor-arg>
                            <!-- Timeout for metadata loading in ms -->
                            <value type="int">5000</value>
                        </constructor-arg>
                        <property name="parserPool" ref="parserPool"/>
                    </bean>
                </constructor-arg>
                <constructor-arg>
                    <bean class="org.springframework.security.saml.metadata.ExtendedMetadata"/>
                </constructor-arg>
                <property name="metadataTrustCheck"  value="false"/>
            </bean>

            <bean class="org.springframework.security.saml.metadata.ExtendedMetadataDelegate">

            <constructor-arg>
                    <bean class="org.opensaml.saml2.metadata.provider.FilesystemMetadataProvider">
                        <constructor-arg>
                            <value type="java.io.File">file:///C:/SP_Metadata.xml</value>
                        </constructor-arg>
                        <property name="parserPool" ref="parserPool"/>
                    </bean>
                </constructor-arg>
                <constructor-arg>
                           <bean class="org.springframework.security.saml.metadata.ExtendedMetadata">
                       <property name="local" value="true"/>
                       <property name="alias" value="defaultAlias"/>
                       <property name="securityProfile" value="metaiop"/>
                       <property name="sslSecurityProfile" value="pkix"/>
                       <property name="signingKey" value="apollo"/>
                       <property name="encryptionKey" value="apollo"/>
                       <property name="requireArtifactResolveSigned" value="true"/>
                       <property name="requireLogoutRequestSigned" value="true"/>
                       <property name="requireLogoutResponseSigned" value="false"/>
                       <property name="idpDiscoveryEnabled" value="true"/>
                       <property name="idpDiscoveryURL" value="https://localhost/mywebapp-SNAPSHOT/saml/discovery/alias/defaultAlias"/>
                       <property name="idpDiscoveryResponseURL" value="https://localhost/mywebapp-SNAPSHOT/saml/login/alias/defaultAlias?disco=true"/>
                    </bean>
                </constructor-arg>
            </bean>
            </list>
        </constructor-arg>
<!-- my SP_metadata had this as the entity id -->
        <property name="hostedSPName" value="urn:test:myapp:auth"/> 
<!-- my idp metadata points to the sso circle idp -->
          <property name="defaultIDP" value="http://idp.ssocircle.com"/> 
    </bean>
user3280968
  • 181
  • 1
  • 8