集成Spring SAML和Oauth2，用于REST API访问的令牌

Question

为REST API访问集成Spring SAML和Oauth2令牌

使用Spring SAML扩展，我能够配置SAML身份验证并能够将断言返回给SP，请点击链接，

现在，它返回到这个“/登陆”，并在SAMLUserDetailsService和SAMLAuthenticationProvider中获取断言和身份验证对象，在SAMLUserDetailsService中填充用户详细信息对象。

@Bean
    public SavedRequestAwareAuthenticationSuccessHandler successRedirectHandler() {
        SavedRequestAwareAuthenticationSuccessHandler successRedirectHandler =
                new SavedRequestAwareAuthenticationSuccessHandler();
        successRedirectHandler.setDefaultTargetUrl("/landing");
        return successRedirectHandler;
    }

现在我的问题是，如何生成Auth token？从这一点来说，没有太多的细节可用，到目前为止我尝试，创建自定义过滤器，拦截“/landing”并尝试修改URL到/oauth/token？grant _ type = urn:IETF:params:oauth:grant-type:Sam L2-bearer

我的 ResourceServerConfiguration.java

@Configuration
@EnableResourceServer
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

    private static final String RESOURCE_ID = "my_rest_api";

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) {
        resources.resourceId(RESOURCE_ID).stateless(false);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.
        anonymous().disable()
        .requestMatchers().antMatchers("/user/**")
        .and().authorizeRequests()
        .antMatchers("/user/**").access("hasRole('ADMIN')")
        .and().exceptionHandling().accessDeniedHandler(new OAuth2AccessDeniedHandler());
    }

}

我的AuthorizationServerConfiguration.java

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {

    private static String REALM="MY_OAUTH_REALM";

    @Autowired
    private TokenStore tokenStore;

    @Autowired
    private UserApprovalHandler userApprovalHandler;

    @Autowired
    @Qualifier("authenticationManagerBean")
    private AuthenticationManager authenticationManager;

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {

        clients.inMemory()
            .withClient("my-trusted-client")
            .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
            .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
            .scopes("read", "write", "trust")
            .secret("secret")
            .accessTokenValiditySeconds(120).//Access token is only valid for 2 minutes.
            refreshTokenValiditySeconds(600);//Refresh token is only valid for 10 minutes.
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.tokenStore(tokenStore).userApprovalHandler(userApprovalHandler)
                .authenticationManager(authenticationManager);
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
        oauthServer.realm(REALM+"/client");
    }

}

谁能建议一下，如何集成它，以便在IDP中完成身份验证，并在IDP成功声明(完成授权部分)后返回到SP，这将生成一个授权访问、刷新令牌，该令牌用户能够访问api。有人能提供某种解决方案吗...

Answer 1

不久前，我遇到了同样的挑战，在弄清楚之后，我写了一篇文章（不能在这里发表…）。基本上，您的oAuth授权服务器是一个“桥梁”，它可以使您的SAML后端适应oAuth，反之亦然。。。在此处查找：

如何将Spring oAuth与Spring SAML集成

GitHub中还有一个包含所有源代码的repo，例如:

https://github.com/OhadR/spring-oAuth2-SAML-integration

我知道它只是链接，但文章太长太详细了。