使用 Spring Security 将 SAMl2.0 令牌转换为 JWT/OIDC

发布于 2025-01-19 07:30:59 字数 227 浏览 1 评论 0原文

我正在使用一个需要使用SAML2.0将OIDC（JWT/ID令牌）支持添加到现有Java Spring应用程序中的团队。你们都有任何建议或资源来帮助解决这个问题吗？

从我所做的小研究中，听起来我们可能有一种方法可以将SAML2.0令牌转换为JSON Web代币/OIDC/ID令牌。那是什么吗？

抱歉，任何措辞都很差，我本质上是一名数据科学家，因此我的软件开发技能并不强。

谢谢大家提供的任何帮助。

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

徒留西风 2025-01-26 07:30:59

听起来我们可能有一种方法可以将SAML2.0令牌转换为JSON Web令牌/OIDC/ID令牌

这听起来像您正在尝试将SAML主张交换以获取访问令牌。在这种情况下，您可以查看 saml断言令牌赠款。另一个选择是治疗本身而不是转换它。我不认为春季安全性支持其中任何一个，但是添加一张票开始对话。

使用SAML2.0
，将OIDC（JWT/ID令牌）添加到现有Java Spring应用程序中

如果我的理解错了，则将 href =“ https://docs.spring.io/spring-security/referenty/5.6.1/servlet/saml2/login/index.html” rel =“ nofollow noreferrer”

http
    .authorizeHttpRequests((authorize) -> authorize.anyRequest().authenticated())
    .oauth2Login(Customizer.withDefaults())
    .saml2Login(Customizer.withDefaults());

这些机制最终将具有自己的个人配置，以便与您的身份提供者正确协调。有关如何执行此操作的链接。

同样，您可能需要在用户代表的用户和主张代表的用户之间进行一些对帐。这种和解最终将取决于您。

it sounds like there may be a way for us to convert a SAML2.0 token into a JSON Web Token/OIDC/ID Token

This sounds like you are trying to exchange the SAML assertion for an access token. In that case, you can look at SAML assertion token grants. Another option is to treat your SAML assertion as a bearer token itself instead of converting it. I don't believe that Spring Security yet supports either of those, but it wouldn't hurt to add a ticket to start that conversation.

add OIDC (JWT/id token) support to an existing Java Spring application using SAML2.0

If I'm wrong in my understanding, though, and what you are saying is that you want to your app to be able to do the SAML SP handshake as well as the OIDC handshake, then Spring Security does support this. You can simply specify both mechanisms like so:

http
    .authorizeHttpRequests((authorize) -> authorize.anyRequest().authenticated())
    .oauth2Login(Customizer.withDefaults())
    .saml2Login(Customizer.withDefaults());

Each of these will ultimately have its own individual configurations necessary in order to coordinate correctly with your Identity Provider. See the links above for how to do this.

Also, there may be some reconciliation you need to do between the user that the Id Token represents and the user that the Assertion represents. That reconciliation will ultimately be up to you to do.

回复收藏 0 原文

~没有更多了~