4

I'm adding SSO support to a spring-based application using the spring-security-saml extension. The idea will be that an IDP can register to use SSO with my application by filling out a form in the UI, specifying their entityId, SSO authentication URL (for SP-initialized login), and public X.509 certificate. This seems to be a common workflow for SaaS applications with SSO support.

I haven't yet been able to find a clean way of implementing this with the spring saml extension, and am wondering if there is one. FilesystemMetadataProvider and HTTPMetadataProvider provide support for loading IDP metadata from an XML file or an HTTP GET, respectively, but I need to instead generate the IDP metadata from the above attributes that are stored in the database.

My current thinking is to use ResourceBackedMetadataProvider and use an implementation of Resource that fetches the metadata attributes from the database for each registered IDP. It would look something like:

class DatabaseBackedResource implements Resource {

    MetadataDao metadataDao; // autowired

    public InputStream getInputStream() throws ResourceException {
        Collection<MetadataPojo> idpMetadata = metadataDao.getMetadata();
        return convertMetadataPojosToInputStream(idpMetadata);
    }

    private InputStream convertMetadataPojosToInputStream(Collection<MetadataPojo> metadata) {
        // somehow convert attributes to XMLObject
        // then write XMLObject to input stream
        // ...
    }

    // implementations of other methods
    // ...

}

where MetadataPojo is simply a wrapper object of the above 3 attributes provided by an IDP. What I'm not sure about is how to generate a valid IDP metadata java object, given some attributes, using the spring saml extension. I see that AbstractMetadataProvider#unmarshallMetadata(InputStream) converts the metadata input stream into an XMLObject, but it is not clear to me how I will convert my collection of MetadataPojos into an XMLObject.

In short, is there a tool in the spring saml extension library to build an IDP metadata xml object given a list of string attributes? Or, taking a step back, is there a better way to implement a MetadataProvider that fetches the metadata information from a database instead of a file or url?

Update:

I implemented the above MetadataProvider implementation and Resource subclass and it's been working like a charm. To generate the IDP metadata documents I used various subclasses of AbstractSAMLObjectBuilder (i.e. EntityDescriptorBuilder, IDPSSODescriptorBuilder, KeyDescriptorBuilder, etc.) and that worked pretty cleanly. It would be nice if the Spring SAML library had an IDPMetadataGenerator class like the MetadataGenerator that exists for SP metadata.

If there was a cleaner way about this, I'd love to hear it.

JCoster22
  • 387
  • 5
  • 9
  • You right - I Didn't want to handle the creation of the metadata. So I just asked for the user for its metadata. Could you please provide your work? Thanks. – Asaf Savich Jan 10 '17 at 15:43

0 Answers0