将Spring Security SAML配置为使用SHA-256作为安全哈希算法

Question

我正在研究Spring SAML和Microsoft ADFS 3.0之间的集成。甚至它已经在Spring SAML的留档中声明为：

双击提供程序打开它，选择tab Advanced并将“安全哈希算法”更改为SHA-1

我知道Spring SAML目前只支持SHA-1作为哈希算法，但我的要求是使用SHA-256。如果我尝试仅在ADFS中为SHA-256配置，它将不起作用。我想我得对Spring SAML做点什么。你知道怎么做吗？

Answer 1

我建议参考以下GitHub示例项目：https://github.com/choonchernlim/spring-security-adfs-saml2

它提供了ADFS专用的配置信息，并详细说明了如何启用SHA-256签名。

Answer 2

您应该将Spring Security配置配置为使用SHA-256签名算法。

您可以重写SAMLBootstrap或配置初始化bean，如下所示：

Spring配置：

<bean id="samlProperties" class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
    <property name="location" value="classpath:saml.properties" />
</bean>
<bean class="your.package.SAMLConfigurationBean">
    <property name="signatureAlgorithm" value="${saml.signatureAlgorithm:SHA1}" />
</bean>

属性文件（saml.properties）：

saml.signatureAlgorithm=SHA256

初始化bean：

package your.package;

import org.opensaml.Configuration;
import org.opensaml.xml.security.BasicSecurityConfiguration;
import org.opensaml.xml.signature.SignatureConstants;
import org.springframework.beans.factory.InitializingBean;

public class SAMLConfigurationBean implements InitializingBean {

    private String signatureAlgorithm ;
    private String digestAlgorithm;

    public void setSignatureAlgorithm(String algorithm) {
        switch (algorithm) {
            case "SHA256" :
                signatureAlgorithm = SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256;
                digestAlgorithm = SignatureConstants.ALGO_ID_DIGEST_SHA256;
                break;
            case "SHA512" :
                signatureAlgorithm = SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512;
                digestAlgorithm = SignatureConstants.ALGO_ID_DIGEST_SHA512;
                break;
            default:
                signatureAlgorithm = SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1;
                digestAlgorithm = SignatureConstants.ALGO_ID_DIGEST_SHA1;
        }
    }

    @Override
    public void afterPropertiesSet() throws Exception {
        BasicSecurityConfiguration config = (BasicSecurityConfiguration) Configuration.getGlobalSecurityConfiguration();
        config.registerSignatureAlgorithmURI("RSA", signatureAlgorithm);
        config.setSignatureReferenceDigestMethod(digestAlgorithm);
    }
}

您也可以跳过可配置部分，满足于此：

初始化bean：

package your.package;

import org.opensaml.Configuration;
import org.opensaml.xml.security.BasicSecurityConfiguration;
import org.opensaml.xml.signature.SignatureConstants;
import org.springframework.beans.factory.InitializingBean;

public class SAMLConfigurationBean implements InitializingBean {

    @Override
    public void afterPropertiesSet() throws Exception {
        BasicSecurityConfiguration config = (BasicSecurityConfiguration) Configuration.getGlobalSecurityConfiguration();
        config.registerSignatureAlgorithmURI("RSA", SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
        config.setSignatureReferenceDigestMethod(SignatureConstants.ALGO_ID_DIGEST_SHA256);
    }
}