Skip to content

Commit

Permalink
Merge pull request #13 from choonchernlim/feature/next
Browse files Browse the repository at this point in the history 
0.8.0
  • Loading branch information
@choonchernlim
choonchernlim committed Jul 13, 2018
2 parents 83c5b7f + 5129825 commit 98672c0
Show file tree
Hide file tree
Showing 4 changed files with 138 additions and 65 deletions.
5 changes: 5 additions & 0 deletions CHANGELOG.md
View file
@@ -1,5 +1,10 @@
# Change Log

## 0.8.0 - 2018-07-11

* Moved from Java 7 to Java 8.
* Dependencies update... organized POM.

## 0.7.1 - 2018-05-04

* BUG - `CsrfHeaderFilter` creates multiple cookies with same name but different path due to possible empty context path, which then uses current request's path. This may cause client side to read the wrong cookie when retrieving the CSRF token.
Expand Down
39 changes: 38 additions & 1 deletion README.md
View file
Expand Up @@ -26,12 +26,13 @@ Tested against IdP's environments:-
<dependency>
<groupId>com.github.choonchernlim</groupId>
<artifactId>spring-security-adfs-saml2</artifactId>
<version>0.7.1</version>
<version>0.8.0</version>
</dependency>
```

## Prerequisites

* Java 8.
* Both Sp and IdP must use HTTPS protocol.
* Java’s default keysize is limited to 128-bit key due to US export laws and a few countries’ import laws. So, Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files must be installed to allow larger key size, such as 256-bit key.
* Keystore must contain both Sp's public/private keys and imported IdP's public certificate.
Expand Down Expand Up @@ -251,3 +252,39 @@ Learn about my pains and lessons learned while building this module.
* [Handling IdP’s Public Certificate When Loading Metadata Over HTTPS](http://myshittycode.com/2016/02/19/spring-security-saml-handling-idps-public-certificate-when-loading-metadata-over-https/)
* [Configuring Binding for Sending SAML Messages to IdP](http://myshittycode.com/2016/02/18/spring-security-saml-configuring-binding-for-sending-saml-messages-to-idp/)
* [Java + SAML: Illegal Key Size](http://myshittycode.com/2016/02/18/java-saml-illegal-key-size/)

## Troubleshooting

### SSL peer failed hostname validation for name: null

By default, this dependency requires a keystore file that serves 2 purposes:-

* Acts as a keystore, containing app's public/private key.
* Acts as a truststore, containing IdP's certificate with public key.

If the keystore does not contain IdP's certificate, the SSL verification will fail with the following error when attempting to retrieve IdP's metadata:-

```
PKIX path construction failed for untrusted credential: [subjectName='CN=idp.server.com,OU=IDP,C=US']: unable to find valid certification path to requested target
I/O exception (javax.net.ssl.SSLPeerUnverifiedException) caught when processing request: SSL peer failed hostname validation for name: null
Error retrieving metadata from https://idp.server.com/federationmetadata/2007-06/federationmetadata.xml
```

That said, sometimes you may want to rely on the installed JDK's truststore (ie: cacerts) to manage IdP's certificate.

To pull this off, don't create `TLSProtocolConfigurer` object by doing this:-

```java
@Configuration
@EnableWebSecurity
class AppSecurityConfig extends SAMLWebSecurityConfigurerAdapter {

@Bean
@Override
TLSProtocolConfigurer tlsProtocolConfigurer() {
return null;
}

...
}
```
155 changes: 93 additions & 62 deletions pom.xml
View file
Expand Up @@ -11,7 +11,7 @@
</parent>

<artifactId>spring-security-adfs-saml2</artifactId>
<version>0.7.1</version>
<version>0.8.0</version>
<packaging>jar</packaging>

<name>Spring Security ADFS SAML2</name>
Expand Down Expand Up @@ -43,117 +43,148 @@
<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
<jdk.version>1.7</jdk.version>
<jdk.version>1.8</jdk.version>

<spring.version>4.3.1.RELEASE</spring.version>
<spring-security.version>4.1.1.RELEASE</spring-security.version>
<spring-security-saml2.version>1.0.2.RELEASE</spring-security-saml2.version>
<spring-security-saml2.version>1.0.3.RELEASE</spring-security-saml2.version>
<spring.version>5.0.7.RELEASE</spring.version>
<spring-security.version>5.0.6.RELEASE</spring-security.version>
<opensaml.version>2.6.4</opensaml.version>
<javaee-api.version>7.0</javaee-api.version>
<pojobuilder.version>3.4.0</pojobuilder.version>
<better-preconditions.version>0.1.1</better-preconditions.version>
<javax.servlet-api.version>3.1.0</javax.servlet-api.version>
<spock-core.version>1.1-groovy-2.4-rc-3</spock-core.version>
<cglib-nodep.version>3.2.4</cglib-nodep.version>
<objenesis.version>2.5.1</objenesis.version>
</properties>

<dependencyManagement>
<dependencies>
<dependency>
<groupId>javax</groupId>
<artifactId>javaee-api</artifactId>
<version>${javaee-api.version}</version>
</dependency>
<dependency>
<groupId>net.karneim</groupId>
<artifactId>pojobuilder</artifactId>
<version>${pojobuilder.version}</version>
</dependency>
<dependency>
<groupId>org.springframework.security.extensions</groupId>
<artifactId>spring-security-saml2-core</artifactId>
<version>${spring-security-saml2.version}</version>
<exclusions>
<exclusion>
<groupId>xml-apis</groupId>
<artifactId>xml-apis</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-core</artifactId>
<version>${spring-security.version}</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-config</artifactId>
<version>${spring-security.version}</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-web</artifactId>
<version>${spring-security.version}</version>
</dependency>
<dependency>
<groupId>org.opensaml</groupId>
<artifactId>opensaml</artifactId>
<version>${opensaml.version}</version>
</dependency>
<dependency>
<groupId>com.github.choonchernlim</groupId>
<artifactId>better-preconditions</artifactId>
<version>${better-preconditions.version}</version>
</dependency>
<dependency>
<groupId>javax.servlet</groupId>
<artifactId>javax.servlet-api</artifactId>
<version>${javax.servlet-api.version}</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-test</artifactId>
<version>${spring.version}</version>
</dependency>
<dependency>
<groupId>org.spockframework</groupId>
<artifactId>spock-core</artifactId>
<version>${spock-core.version}</version>
</dependency>
<dependency>
<groupId>cglib</groupId>
<artifactId>cglib-nodep</artifactId>
<version>${cglib-nodep.version}</version>
</dependency>
<dependency>
<groupId>org.objenesis</groupId>
<artifactId>objenesis</artifactId>
<version>${objenesis.version}</version>
</dependency>
</dependencies>
</dependencyManagement>

<dependencies>
<!-- Scope = provided. -->
<!-- Scope: Provided -->
<dependency>
<groupId>javax</groupId>
<artifactId>javaee-api</artifactId>
<version>7.0</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>net.karneim</groupId>
<artifactId>pojobuilder</artifactId>
<version>3.4.0</version>
<scope>provided</scope>
</dependency>

<!-- Scope: Compile -->
<dependency>
<groupId>org.springframework.security.extensions</groupId>
<artifactId>spring-security-saml2-core</artifactId>
<version>${spring-security-saml2.version}</version>
<exclusions>
<!-- Remove dependency that causes problem in WAS -->
<exclusion>
<groupId>xml-apis</groupId>
<artifactId>xml-apis</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-core</artifactId>
<version>${spring-security.version}</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-config</artifactId>
<version>${spring-security.version}</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-web</artifactId>
<version>${spring-security.version}</version>
</dependency>
<dependency>
<groupId>org.opensaml</groupId>
<artifactId>opensaml</artifactId>
<version>2.6.4</version>
</dependency>
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>19.0</version>
</dependency>
<dependency>
<groupId>com.github.choonchernlim</groupId>
<artifactId>better-preconditions</artifactId>
<version>0.1.1</version>
</dependency>

<!-- Scope: Test -->
<dependency>
<groupId>javax.servlet</groupId>
<artifactId>javax.servlet-api</artifactId>
<version>3.1.0</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-test</artifactId>
<version>${spring.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.codehaus.groovy</groupId>
<artifactId>groovy-all</artifactId>
<version>2.4.6</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava-testlib</artifactId>
<version>19.0</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.spockframework</groupId>
<artifactId>spock-core</artifactId>
<version>1.1-groovy-2.4-rc-1</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>4.12</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>cglib</groupId>
<artifactId>cglib-nodep</artifactId>
<version>3.2.4</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.objenesis</groupId>
<artifactId>objenesis</artifactId>
<version>2.4</version>
<scope>test</scope>
</dependency>
</dependencies>
Expand All @@ -163,7 +194,7 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<version>3.5.1</version>
<version>3.7.0</version>
<configuration>
<compilerId>groovy-eclipse-compiler</compilerId>
<source>${jdk.version}</source>
Expand Down
4 changes: 2 additions & 2 deletions src/main/java/com/github/choonchernlim/security/adfs/saml2/DefaultSAMLBootstrap.java
View file
Expand Up @@ -10,9 +10,9 @@

/**
* By default, Spring Security SAML uses SHA1withRSA for signature algorithm and SHA-1 for digest algorithm.
* <p></p>
* <p>
* This class allows app to use stronger encryption such as SHA-256.
* <p></p>
* <p>
* See: http://stackoverflow.com/questions/23681362/how-to-change-the-signature-algorithm-of-saml-request-in-spring-security
* See: http://stackoverflow.com/questions/25982093/setting-the-extendedmetadata-signingalgorithm-field/26004147
*/
Expand Down

0 comments on commit 98672c0

Please sign in to comment.