19 | * This approach is approved by Rob Winch, the project lead of Spring Security. 20 | */ 21 | final class CsrfHeaderFilter extends OncePerRequestFilter { 22 | /** 23 | * Header name to match AngularJS's spec to ensure this filter is more compatible with major 24 | * client-side MV* frameworks. 25 | */ 26 | static final String HEADER_NAME = "X-XSRF-TOKEN"; 27 | 28 | /** 29 | * Cookie name to match AngularJS's spec to ensure this filter is more compatible with major 30 | * client-side MV* frameworks. 31 | */ 32 | static final String COOKIE_NAME = "XSRF-TOKEN"; 33 | 34 | @Override 35 | protected void doFilterInternal(final HttpServletRequest request, 36 | final HttpServletResponse response, 37 | final FilterChain filterChain) 38 | throws ServletException, IOException { 39 | 40 | final CsrfToken csrf = (CsrfToken) request.getAttribute(CsrfToken.class.getName()); 41 | 42 | if (csrf != null) { 43 | final String token = csrf.getToken(); 44 | final Cookie existingCookie = WebUtils.getCookie(request, COOKIE_NAME); 45 | 46 | // If there's no existing cookie or the token value doesn't match, create/update it. 47 | // 48 | // `domain` = Don't need to set this so that the current request's domain will be used. 49 | // `httpOnly` = Cannot set this value because we need JS to be able to read this cookie to get the token. 50 | // `path` = Match app's root context so that only the app can access this cooke. 51 | // If path is empty, set it as '/' to prevent using the resource path currently requested. 52 | // This prevents creating too many cookies with the same name but different paths 53 | // (due to bookmark-able links) because client side will have difficulties grabbing 54 | // the right CSRF token value from the right cookie. 55 | // Regarding path not set, see See https://en.wikipedia.org/wiki/HTTP_cookie#Domain_and_path 56 | // 57 | // `secure` = Cookie to only be transmitted over secure protocol as https 58 | // 59 | // `maxAge` = Expire the cookie after 8 hours. Cannot use HTTP session timeout value because this 60 | // cookie will only get created/updated if the token value is different instead of 61 | // every time user refreshes the session by interacting with server side. 62 | if (existingCookie == null || !token.equals(existingCookie.getValue())) { 63 | final Cookie cookie = new Cookie(COOKIE_NAME, token); 64 | final String path = MoreObjects.firstNonNull( 65 | Strings.emptyToNull(request.getServletContext().getContextPath()), "/"); 66 | 67 | cookie.setPath(path); 68 | cookie.setSecure(true); 69 | cookie.setMaxAge(60 * 60 * 8); 70 | response.addCookie(cookie); 71 | } 72 | } 73 | 74 | filterChain.doFilter(request, response); 75 | } 76 | } 77 | -------------------------------------------------------------------------------- /src/main/java/com/github/choonchernlim/security/adfs/saml2/CustomAuthnContext.java: -------------------------------------------------------------------------------- 1 | package com.github.choonchernlim.security.adfs.saml2; 2 | 3 | /** 4 | * ADFS-specific authentication method. 5 | */ 6 | public final class CustomAuthnContext { 7 | /** 8 | * Windows integration authentication. 9 | */ 10 | public static final String WINDOWS_INTEGRATED_AUTHN_CTX = "urn:federation:authentication:windows"; 11 | } 12 | -------------------------------------------------------------------------------- /src/main/java/com/github/choonchernlim/security/adfs/saml2/DefaultSAMLBootstrap.java: -------------------------------------------------------------------------------- 1 | package com.github.choonchernlim.security.adfs.saml2; 2 | 3 | import static com.github.choonchernlim.betterPreconditions.preconditions.PreconditionFactory.expect; 4 | import org.opensaml.Configuration; 5 | import org.opensaml.xml.security.BasicSecurityConfiguration; 6 | import org.opensaml.xml.signature.SignatureConstants; 7 | import org.springframework.beans.BeansException; 8 | import org.springframework.beans.factory.config.ConfigurableListableBeanFactory; 9 | import org.springframework.security.saml.SAMLBootstrap; 10 | 11 | /** 12 | * By default, Spring Security SAML uses SHA1withRSA for signature algorithm and SHA-1 for digest algorithm. 13 | *
14 | * This class allows app to use stronger encryption such as SHA-256. 15 | *
16 | * See: http://stackoverflow.com/questions/23681362/how-to-change-the-signature-algorithm-of-saml-request-in-spring-security
17 | * See: http://stackoverflow.com/questions/25982093/setting-the-extendedmetadata-signingalgorithm-field/26004147
18 | */
19 | public final class DefaultSAMLBootstrap extends SAMLBootstrap {
20 |
21 | private final String signatureAlgorithmName;
22 | private final String signatureAlgorithmURI;
23 | private final String digestAlgorithmURI;
24 |
25 | /**
26 | * Default signature algorithm is SHA256withRSA and default digest algorithm is SHA-256.
27 | */
28 | public DefaultSAMLBootstrap() {
29 | this("RSA", SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256, SignatureConstants.ALGO_ID_DIGEST_SHA256);
30 | }
31 |
32 | /**
33 | * Allows user to specify different algorithm URIs.
34 | *
35 | * @param signatureAlgorithmName Signature algorithm name
36 | * @param signatureAlgorithmURI Signature algorithm URI
37 | * @param digestAlgorithmURI Digest algorithm URI
38 | */
39 | public DefaultSAMLBootstrap(final String signatureAlgorithmName,
40 | final String signatureAlgorithmURI,
41 | final String digestAlgorithmURI) {
42 | //@formatter:off
43 | this.signatureAlgorithmName = expect(signatureAlgorithmName, "Signature algorithm name").not().toBeBlank().check();
44 | this.signatureAlgorithmURI = expect(signatureAlgorithmURI, "Signature algorithm URI").not().toBeBlank().check();
45 | this.digestAlgorithmURI = expect(digestAlgorithmURI, "Digest algorithm URI").not().toBeBlank().check();
46 | //@formatter:on
47 | }
48 |
49 | @Override
50 | public void postProcessBeanFactory(ConfigurableListableBeanFactory beanFactory) throws BeansException {
51 | super.postProcessBeanFactory(beanFactory);
52 | BasicSecurityConfiguration config = (BasicSecurityConfiguration) Configuration.getGlobalSecurityConfiguration();
53 | config.registerSignatureAlgorithmURI(signatureAlgorithmName, signatureAlgorithmURI);
54 | config.setSignatureReferenceDigestMethod(digestAlgorithmURI);
55 | }
56 | }
57 |
--------------------------------------------------------------------------------
/src/main/java/com/github/choonchernlim/security/adfs/saml2/JndiBackedKeystoreService.java:
--------------------------------------------------------------------------------
1 | package com.github.choonchernlim.security.adfs.saml2;
2 |
3 | import static com.github.choonchernlim.betterPreconditions.preconditions.PreconditionFactory.expect;
4 | import com.google.common.base.Splitter;
5 | import org.springframework.core.io.DefaultResourceLoader;
6 | import org.springframework.core.io.Resource;
7 | import org.springframework.core.io.ResourceLoader;
8 | import org.springframework.jndi.JndiTemplate;
9 |
10 | import java.io.InputStream;
11 | import java.security.KeyStore;
12 | import java.util.Iterator;
13 | import java.util.List;
14 |
15 | /**
16 | * Helper class that retrieves JNDI value and returns a keystore bean.
17 | * The JNDI value has the following format: "jks-path,alias,storepass,keypass"
18 | */
19 | public class JndiBackedKeystoreService {
20 | private final ResourceLoader resourceLoader = new DefaultResourceLoader();
21 |
22 | /**
23 | * JNDI name
24 | */
25 | private final String jndiName;
26 |
27 | private JndiTemplate jndiTemplate = new JndiTemplate();
28 |
29 | public JndiBackedKeystoreService(final String jndiName) {
30 | this.jndiName = jndiName;
31 | }
32 |
33 | /**
34 | * For mocking out instance during testing.
35 | *
36 | * @param jndiTemplate Jndi template
37 | */
38 | public void setJndiTemplate(final JndiTemplate jndiTemplate) {
39 | this.jndiTemplate = jndiTemplate;
40 | }
41 |
42 | /**
43 | * Retrieves keystore info from JNDI.
44 | *
45 | * @return Keystore bean
46 | */
47 | public KeystoreBean get() {
48 | final Iterator