saml - Spring Security multiple authentication provider not getting to the second one -
i have app uses spring security, using custom authentication provider fine. need add saml idp mix now. got sample saml application , running , use security context base. have manager defined this:
<security:authentication-manager alias="authenticationmanager"> <security:authentication-provider ref="myauthenticationprovider" /> <security:authentication-provider ref="samlauthenticationprovider"/> </security:authentication-manager>
now when submit login form username/passeord in saml idp, can see logs calls myauthenticationprovider, throws badcredentialsexception, nothing. don't see other exception, , not peep out of samlauthenticationprovider.
i have read documentation few times, , seems indicate can done, don't see example. have example of using saml , basicauthentication?
i don't think need add authentication provider new idp. need add new ?? in cachingmetadatamanager bean. in securitycontext.xml provided in sample app:
<!-- idp metadata configuration - paths metadata of idps in circle of trust here --> <bean id="metadata" class="org.springframework.security.saml.metadata.cachingmetadatamanager"> <constructor-arg> <list> <!-- example of classpath metadata extended metadata --> <bean class="org.springframework.security.saml.metadata.extendedmetadatadelegate"> <constructor-arg> <bean class="org.opensaml.saml2.metadata.provider.resourcebackedmetadataprovider"> <constructor-arg> <bean class="java.util.timer"/> </constructor-arg> <constructor-arg> <bean class="org.opensaml.util.resource.classpathresource"> <constructor-arg value="/metadata/idp.xml"/> </bean> </constructor-arg> <property name="parserpool" ref="parserpool"/> </bean> </constructor-arg> <constructor-arg> <bean class="org.springframework.security.saml.metadata.extendedmetadata"> </bean> </constructor-arg> </bean> <!-- example of http metadata without extended metadata --> <bean class="org.opensaml.saml2.metadata.provider.httpmetadataprovider"> <!-- url containing metadata --> <constructor-arg> <value type="java.lang.string">http://idp.ssocircle.com/idp-meta.xml</value> </constructor-arg> <!-- timeout metadata loading in ms --> <constructor-arg> <value type="int">15000</value> </constructor-arg> <property name="parserpool" ref="parserpool"/> </bean> <!-- example of file system metadata without extended metadata --> <bean class="org.opensaml.saml2.metadata.provider.filesystemmetadataprovider"> <constructor-arg> <value type="java.io.file">/usr/local/metadata/idp.xml</value> </constructor-arg> <property name="parserpool" ref="parserpool"/> </bean> </list> </constructor-arg> </bean>
if un-comment second bean in list, enable idp specified in xml file provided @ /usr/local/metadata/idp.xml
. if want add metadata of idp on http, copy 1 ssocircle , make adjustments.
Comments
Post a Comment