Having recently implemented SAML authentication for an application I found the most useful information in the OASIS SAML2 technical overview document. It's very readable and contains real examples of the XML messages that are passed.
Section 5.1 describes the interaction of having YOUR application (service provider or SP) request authentication to a remote identity provider (Idp).
Providing more up to date answer since this hasn't been visited in a while:
If you're doing a spring project already I've had success with Spring Security SAML. You do not have to be securing your app with Spring Security to use the SAML extension, though it make it a bit easier.
Both have a rather impressive features list and offer a wide list of SSO agents.
The main benefit of the agent approach is that you don't have to care in your application about the authentication process as it is handled by the agent and the SSO infrastructure.
If you're going to develop your own SAML2 Service Provider, using OpenSAML is the way to go. The downside is that this library is not that well documented. Nevertheless you should find easily some tutorials on OpenSAML on the web. You could implement it for example as a servlet filter, so that your application code is not tied to SAML.
发布评论
评论（6）
最近为应用程序实施了 SAML 身份验证，我在 OASIS SAML2 技术概述文档中找到了最有用的信息。它非常易读并且包含所传递的 XML 消息的真实示例。
第 5.1 节描述了让您的应用程序（服务提供商或 SP）向远程身份提供商 (Idp) 请求身份验证的交互。
http://wiki.oasis-open.org/security/Saml2TechOverview
Having recently implemented SAML authentication for an application I found the most useful information in the OASIS SAML2 technical overview document. It's very readable and contains real examples of the XML messages that are passed.
Section 5.1 describes the interaction of having YOUR application (service provider or SP) request authentication to a remote identity provider (Idp).
http://wiki.oasis-open.org/security/Saml2TechOverview
提供更多最新答案，因为有一段时间没有访问过这个问题：
如果您已经在做一个 Spring 项目，我已经使用 Spring Security SAML 取得了成功。您不必使用 Spring Security 来保护您的应用程序即可使用 SAML 扩展，尽管这会让事情变得更容易一些。
http://projects.spring.io/spring-security-saml/
Providing more up to date answer since this hasn't been visited in a while:
If you're doing a spring project already I've had success with Spring Security SAML. You do not have to be securing your app with Spring Security to use the SAML extension, though it make it a bit easier.
http://projects.spring.io/spring-security-saml/
http://www.softwareborsen.dk/projekter/softwarecenter/brugerstyring/ oio-saml-java
http://www.softwareborsen.dk/projekter/softwarecenter/brugerstyring/oio-saml-java
您需要的一切都位于 OpenSSO 站点，其中 OpenAM 作为它的后继者。
Everything you need was at the OpenSSO site, with OpenAM as it's successor.
您可以尝试 OpenSAML 项目；它提供了一个用于创建和验证 SAML 令牌的 Java 库。
You can try the OpenSAML project; it provides a Java library for creating and validating SAML tokens.
您可以看一下 2 个产品：
两者都有相当令人印象深刻的功能列表，并提供广泛的功能SSO 代理列表。
代理方法的主要优点是您不必在应用程序中关心身份验证过程，因为它是由代理和 SSO 基础结构处理的。
如果您要开发自己的 SAML2 服务提供商，那么使用 OpenSAML 是最佳选择。缺点是这个库没有很好的文档记录。不过，您应该可以在网络上轻松找到一些有关 OpenSAML 的教程。
例如，您可以将其实现为 servlet 过滤器，这样您的应用程序代码就不会与 SAML 绑定。
You could take a look at 2 products:
Both have a rather impressive features list and offer a wide list of SSO agents.
The main benefit of the agent approach is that you don't have to care in your application about the authentication process as it is handled by the agent and the SSO infrastructure.
If you're going to develop your own SAML2 Service Provider, using OpenSAML is the way to go. The downside is that this library is not that well documented. Nevertheless you should find easily some tutorials on OpenSAML on the web.
You could implement it for example as a servlet filter, so that your application code is not tied to SAML.