问题
I've successfully implemented SSO authentication using Spring-SAML extension. Primary requirement for us to support IDP-initiated SSO to our application. Well, by using the configurations from spring-security-saml2-sample even SP-initiated SSO flow also works for us.
Question: Is keystore is used in IDP-initiated SSO (if metadata has certificate)? If not used, I would like to get rid of keystore configurations from securityContext.xml.
Note: SP-initiated SSO and Global logout is not needed for us. We use Okta as IDP.
回答1:
This is a good feature request. I've opened https://jira.spring.io/browse/SES-160 for you and support is available in Spring SAML's trunk with the following documentation:
In case your application doesn't need to create digital signatures and/or decrypt incoming messages, it is possible to use an empty implementation of the keystore which doesn't require any JKS file -
org.springframework.security.saml.key.EmptyKeyManager
. This can be the case for example when using only IDP-Initialized single sign-on. Please note that when using theEmptyKeyManager
some of Spring SAML features will be unavailable. This includes at least SP-initialized Single Sign-on, Single Logout, usage of additional keys inExtendedMetadata
and verification of metadata signatures. Use the following bean in order to initialize theEmptyKeyManager
:
<bean id="keyManager" class="org.springframework.security.saml.key.EmptyKeyManager"/>
来源:https://stackoverflow.com/questions/28605002/do-we-need-keystore-jkskeymanager-in-idp-initiated-sso-saml