Spring Security from 2.1.0 -> 2.5.0 SAML - many deprecations

user_10461625 0
Viewed 320

Small question regarding Spring Security 2.5.0 please.

Used to have a Spring Boot + Spring Security project at 2.1.0.

Now I did the upgrade, bumped up to Spring Boot 2.5.0 + spring-security-saml2-service-provider 5.5.0

Business logics working fine, we are using this for SAML authentication, no issues.

A snippet we have is:

  //local signing (and decryption key)
        Saml2X509Credential signingCredential = getSigningCredential();
        //IDP certificate for verification of incoming messages
        Saml2X509Credential idpVerificationCertificate = getVerificationCertificate();
        String acsUrlTemplate = "{baseUrl}" + Saml2WebSsoAuthenticationFilter.DEFAULT_FILTER_PROCESSES_URI;
        return RelyingPartyRegistration.withRegistrationId(registrationId)
                .remoteIdpEntityId(idpEntityId)
                .idpWebSsoUrl(webSsoEndpoint)
                .credentials(c -> c.add(signingCredential))
                .credentials(c -> c.add(idpVerificationCertificate))
                .localEntityIdTemplate(localEntityIdTemplate)
                .assertionConsumerServiceUrlTemplate(acsUrlTemplate)
                .build();

Again, working quite well.

We bumped the project up to the latest (as of time of this writing) 2.5.0, and saw deprecation in most of the lines of the snippet.

Tried to look in Spring Security 5.5.0, where it recommends to use assertionConsumerServiceLocation instead.

But I am having a hard time understanding, what is the string replacing everything?

return RelyingPartyRegistration.withRegistrationId(registrationId).assertionConsumerServiceLocation("what comes here?").build();

Any help please?

spring-security spring java
2 Answers

The motivation for the deprecations is that we should use Spec Language in RelyingPartyRegistration.

The conventions were changed to better follow the metadata descriptors that the registration is meant to represent.

For example, RelyingPartyRegistration.ProviderDetails contains a method called getWebSsoUrl, but this doesn't readily map to anything in the IDPSSODescriptor. It would be clearer to name it getSingleSignOnServiceLocation since this information is located in <SingleSignOnService Location='${LOCATION}'/>.

You can see what you should use instead in the method's javadoc. Like so:

/**
 * @deprecated Use {@link #assertionConsumerServiceLocation} instead.
 */
@Deprecated
public Builder assertionConsumerServiceUrlTemplate(String assertionConsumerServiceUrlTemplate) {
    this.assertionConsumerServiceLocation = assertionConsumerServiceUrlTemplate;
    return this;
}

Or just open the file in the Spring Security official repository.

user_54548420

After review of Spring Security doc, this is the equivalent in the new Spring security 5.5+ version:

RelyingPartyRegistration getSaml2AuthenticationConfiguration()  {
        //remote IDP entity ID
        String idpEntityId = "https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/SSOService.php";

        //remote WebSSO Endpoint - Where to Send AuthNRequests to
        String webSsoEndpoint = "https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/metadata.php";

        String acsUrlTemplate = "{baseUrl}" + Saml2WebSsoAuthenticationFilter.DEFAULT_FILTER_PROCESSES_URI;

        //local signing (and decryption key)
        Saml2X509Credential relyingPartySigningCredential = getSigningCredential();
        //IDP certificate for verification of incoming messages
        Saml2X509Credential assertingPartyVerificationCredential = getVerificationCertificate();

        //local registration ID
        String registrationId = "registrationId";
        //local entity ID - autogenerated based on URL
        String localEntityIdTemplate = "localEntityIdTemplate";

        return RelyingPartyRegistration
                .withRegistrationId(registrationId)
                .entityId(localEntityIdTemplate)
                .assertionConsumerServiceLocation(acsUrlTemplate)
                .signingX509Credentials(c -> c.add(relyingPartySigningCredential))
                .assertingPartyDetails(details -> details
                        .verificationX509Credentials(c -> c.add(assertingPartyVerificationCredential))
                        .singleSignOnServiceLocation(webSsoEndpoint)
                        .entityId(idpEntityId)).build();

    }
user_104616250
Related