Wednesday, September 3, 2014

Spring Secuirty SAML extension, Configuration for Proxy Server



Spring Security SAML extension project uses Spring Property Placeholder Configurer, and reads properties using the contextConfigLocation parameter as shown below:
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
/WEB-INF/securityContext.xml
</param-value>
</context-param>
The default configuration as provided by the project is for single server configuration.  The project also supports proxy server configuration with minimal configuration changes and all changes configurable through the contextConfigLocation file.  The configuration parameters for the proxy configuration shown below are described here:
 

Just replace the default metadataGeneratorFilter  configuration with contextProvider as shown below:
<bean id="metadataGeneratorFilter" class="org.springframework.security.saml.metadata.MetadataGeneratorFilter">
<constructor-arg>
<bean class="org.springframework.security.saml.metadata.MetadataGenerator">
<property name="entityBaseURL" value="https://www.myserver.com/spring-security-saml2-sample"/>
</bean>
</constructor-arg>
</bean>

<bean id="contextProvider" class="org.springframework.security.saml.context.SAMLContextProviderLB">
<property name="scheme" value="http(s)"/>
<property name="serverName" value="apache.saml.org"/>
<property name="serverPort" value="80"/>
<property name="includeServerPortInRequestURL" value="true/>
<property name="contextPath" value="<application context root>"/>
</bean>
Note that all properties defined correspond to the proxy server, not the application server on which the application is deployed.  With this minor change the secured application can be accessed through the proxy/Load Balancer.