I have an app that already has a login system and user objects, etc. I want to adapt it so it can authenticate using a SAML identity provider.
To do so I need to construct a page that sends the user to the identity provider to login. Here is what I've come up with so far to test with:
public String getSamlLoginPage() throws IOException, ConfigurationException {
DefaultBootstrap.bootstrap();
AuthnRequest authnRequest = buildSamlObject(AuthnRequest.DEFAULT_ELEMENT_NAME,AuthnRequestBuilder.class);
String myResponseUrl = "http://localhost:8080/samltest/saml?action=samlLogin";
String serviceProviderEntityId = "someProviderEntityId";
// set information in request
{
authnRequest.setForceAuthn(false);
authnRequest.setIsPassive(false);
authnRequest.setIssueInstant(new DateTime());
authnRequest.setDestination(myResponseUrl);
authnRequest.setProtocolBinding(SAMLConstants.SAML2_ARTIFACT_BINDING_URI);
authnRequest.setAssertionConsumerServiceURL(myResponseUrl);
authnRequest.setID(""+UUID.randomUUID().getLeastSignificantBits());
Issuer issuer = buildSamlObject(Issuer.DEFAULT_ELEMENT_NAME, IssuerBuilder.class);
issuer.setValue(serviceProviderEntityId);
authnRequest.setIssuer(issuer);
NameIDPolicy nameIDPolicy = buildSamlObject(NameIDPolicy.DEFAULT_ELEMENT_NAME, NameIDPolicyBuilder.class);
nameIDPolicy.setSPNameQualifier(serviceProviderEntityId);
nameIDPolicy.setAllowCreate(true);
nameIDPolicy.setFormat("urn:oasis:names:tc:SAML:2.0:nameid-format:transient");
authnRequest.setNameIDPolicy(nameIDPolicy);
RequestedAuthnContext requestedAuthnContext = buildSamlObject(RequestedAuthnContext.DEFAULT_ELEMENT_NAME,RequestedAuthnContextBuilder.class);
requestedAuthnContext.setComparison(AuthnContextComparisonTypeEnumeration.MINIMUM);
AuthnContextClassRef authnContextClassRef = buildSamlObject(AuthnContextClassRef.DEFAULT_ELEMENT_NAME,AuthnContextClassRefBuilder.class);
authnContextClassRef.setAuthnContextClassRef("urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport");
requestedAuthnContext.getAuthnContextClassRefs().add(authnContextClassRef);
authnRequest.setRequestedAuthnContext(requestedAuthnContext);
}
String samlRequestStr = XMLUtil.doc2String( authnRequest.getDOM() );
byte[] samlRequest = samlRequestStr.getBytes(); // <samlp:AuthnRequest>
ByteArrayOutputStream bout = new ByteArrayOutputStream(500);
Base64.encode(samlRequest,bout);
return
"<html><body>"
+"<form method=\"post\" action=\"https://idp.example.org/SAML2/SSO/POST\">"
+" <input type=\"hidden\" name=\"SAMLRequest\" value=\""+ bout.toString() +"\" />"
// +" <input type=\"hidden\" name=\"RelayState\" value=\"someToken\" />"
+" <input type=\"submit\" value=\"Submit\" />"
+" </form>"
+"<body></html>";
}
private <SAMLObjectType extends SAMLObject, BuilderT extends SAMLObjectBuilder<SAMLObjectType>> SAMLObjectType buildSamlObject(javax.xml.namespace.QName defaultElementName, Class<BuilderT> type) {
XMLObjectBuilderFactory builderFactory = org.opensaml.Configuration.getBuilderFactory();
BuilderT requestBuilder = (BuilderT)builderFactory.getBuilder(defaultElementName);
return requestBuilder.buildObject();
}
I'll need to change the action to point to the actual identity provider. Beyond that, what am I supposed to put into the Request object? All I need is for the identity provider to verify that the user is a real user (they'll login with email and password at the identity provider) and then communicate to me what their email address is along with some sort of signature that I can validate to prove that the user has been validated by the identity provider.
All other information about the user is stored locally, so email and idp signature is all I need.