使用spring-security-saml在RP元数据中包含所需的声明

Question

有没有办法在使用spring-security-saml的依赖方的元数据响应中包含所需的声明？

理想情况下，我希望向各种IdP提供联合元数据URL，该URL还指定我们作为RP所需的索赔类型（即电子邮件地址，给定名称，姓氏等）。我目前正在使用ADFS作为身份提供商进行测试。使用RP元数据URL向向导添加信赖方信任时，除“接受的声明”选项卡外，大多数信息都已预先填写。

我尝试手动修改元数据xml（在the docs中指定）以在RoleDescriptor中包含ClaimTypesRequired或ClaimTypesRequested元素，虽然我不确定要添加什么...我也更喜欢如果可能的话，坚持使用自动生成的元数据。

我对RP元数据网址的理解是否正确？或者我会更好地为IdP提供URL，然后告诉他们添加额外的声明。

Answer 1

感谢Vladimír的建议，我扩展了MetadataGenerator类，添加了AttributeConsumingService和RequestedAttribute元素，如下所示。我在这里张贴它以防万一它可以帮助任何人。

public class MySAMLMetadataGenerator extends MetadataGenerator
{
   @Override
   protected SPSSODescriptor buildSPSSODescriptor(String entityBaseURL, String entityAlias, boolean requestSigned, boolean wantAssertionSigned, Collection<String> includedNameID)
   {
      SPSSODescriptor descriptor = super.buildSPSSODescriptor(entityBaseURL, entityAlias, requestSigned, wantAssertionSigned, includedNameID);
      descriptor.getAttributeConsumingServices().add(generateConsumingService());
      return descriptor;
   }

   private AttributeConsumingService generateConsumingService()
   {
      SAMLObjectBuilder<AttributeConsumingService> builder = (SAMLObjectBuilder<AttributeConsumingService>) builderFactory.getBuilder(AttributeConsumingService.DEFAULT_ELEMENT_NAME);
      AttributeConsumingService service = builder.buildObject();

      SAMLObjectBuilder<ServiceName> builder2 = (SAMLObjectBuilder<ServiceName>) builderFactory.getBuilder(ServiceName.DEFAULT_ELEMENT_NAME);
      ServiceName serviceName = builder2.buildObject();
      serviceName.setName(new LocalizedString("application name", "en"));
      service.getNames().add(serviceName);

      SAMLObjectBuilder<ServiceDescription> builder3 = (SAMLObjectBuilder<ServiceDescription>) builderFactory.getBuilder(ServiceDescription.DEFAULT_ELEMENT_NAME);
      ServiceDescription serviceDescription = builder3.buildObject();
      serviceDescription.setDescription(new LocalizedString("Application description", "en"));
      service.getDescriptions().add(serviceDescription);

      SAMLObjectBuilder<RequestedAttribute> builder4 = (SAMLObjectBuilder<RequestedAttribute>) builderFactory.getBuilder(RequestedAttribute.DEFAULT_ELEMENT_NAME);
      RequestedAttribute nameId = builder4.buildObject();
      nameId.setIsRequired(true);
      nameId.setFriendlyName("Name ID");
      nameId.setName("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier");
      nameId.setNameFormat("urn:oasis:names:tc:SAML:2.0:attrname-format:uri");
      service.getRequestAttributes().add(nameId);

      RequestedAttribute email = builder4.buildObject();
      email.setIsRequired(true);
      email.setFriendlyName("E-Mail Address");
      email.setName("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress");
      email.setNameFormat("urn:oasis:names:tc:SAML:2.0:attrname-format:uri");
      service.getRequestAttributes().add(email);

      RequestedAttribute givenName = builder4.buildObject();
      givenName.setIsRequired(true);
      givenName.setFriendlyName("Given Name");
      givenName.setName("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname");
      givenName.setNameFormat("urn:oasis:names:tc:SAML:2.0:attrname-format:uri");
      service.getRequestAttributes().add(givenName);

      RequestedAttribute surname = builder4.buildObject();
      //surname.setIsRequired(true);
      surname.setFriendlyName("Surname");
      surname.setName("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname");
      surname.setNameFormat("urn:oasis:names:tc:SAML:2.0:attrname-format:uri");
      service.getRequestAttributes().add(surname);

      service.setIndex(1);

      return service;
   }
}

不幸的是，Microsoft ADFS服务器doesn't seem to support这些属性用于自动设置声明。所以不要浪费你的时间试图让它像我一样工作！

Answer 2

在自动生成的Spring SAML元数据中，对所请求的声明没有开箱即用的支持。但您可以扩展MetadataGenerator class以根据需要导出其他数据。