At some point we all need to integrate our application with the security system used by the customer. Single Sign-On and the SAML protocol quickly becomes the standard in how web applications authenticate. In this session we'll go over the SAML principles and show how we can implement these principles in a Spring Security-enabled J2EE application.

1. Ordina JOIN 2014
Ken Coenen
@CoenenKen
Senior Java Developer
Architecture & Best Practices Competence Lead at Ordina
Integrating Spring Security and SAML

2. SAML

3. What is SAML?
▪ Security Assertion Markup Language
▪ XML protocol
▪ Approved standard
▪ SAML 2.0 dates from March 2005
▪ Used for eg. Single Sign-On (SSO)

4. SAML overview
▪ Identity Provider (IDP)
Authenticating party
▪ Service Provider (SP)
Relies on the IDP and provides
a service
▪ Circle of Trust (COT)
Group of trusted SPs

5. SAML sequence
1. User requests access to a
service
2. Redirect to IDP logon page
3. POST to IDP
4. Redirect to application
5. User can access any
application in the Circle of
Trust

6. Spring Security

7. What is Spring Security?
▪ Part of the Spring framework
http://projects.spring.io/spring-security/
▪ Provides dozens of customizable security features
▪ Authentication and Authorization
→ For now we’ll focus on authentication
▪ Support for a wide range of authentication models
▪ Possible to write your own
→ That’s what we’ll do!

8. Authentication Concepts
▪ Filter Chain
▪ Security rules for your application
▪ Entry Point
▪ How an unauthenticated user tries to access secured resources
▪ eg. Form login, OpenID, basic authentication, ...
▪ Manager
▪ Manages authentication requests
▪ Uses AuthenticationProvider and User Details Service

9. Putting the pieces together

10. Include Maven dependencies
Check latest dependencies on http:
//projects.spring.io/spring-security/

11. Include Maven dependencies (2)
OpenAM library to interpret
SAML assertion and
perform redirects

12. Map Spring Security filter in web.xml
▪ Let your J2EE application know we’re using Spring Security

13. Authentication Filter Chain

14. Filter Chain
Triggered if not authenticated
1. Redirect to IDP
2. Process SAML
assertion

15. ▪ Extends GenericFilterBean
Request initiator
Redirect to the IDP

16. Process the SAML response
▪ Extends AbstractAuthenticationProcessingFilter
Wrap our SAML assertion in a PreAuthenticated-
AuthenticationToken in the request parameters

17. Processes
Authentication
object
Authentication Manager
Triggers the User Details
Service to authenticate the
user
Interpret
SAML
attributes

18. ▪ Extends AuthenticationUserDetailsService
<PreAuthenticatedAuthenticationToken>
▪ Maps SAML assertions to Spring privileges
Custom User Details Service

19. Q&A