OpenSAML 2 到 3 迁移，如何进行身份验证重定向？

Question

我将项目中的 OpenSAML 依赖项从 2.6.5 更新到 3.3.0，并成功迁移了大部分代码，包括库的初始化。我无法迁移的唯一最后一种方法是负责身份验证重定向的方法。这是使用 OpenSAML 2 实现的方式：

private void doAuthenticationRedirect(HttpServletRequest request, HttpServletResponse response) throws Exception {
    AuthnRequest authnRequest = buildAuthnRequestObject();

    HttpServletResponseAdapter responseAdapter = new HttpServletResponseAdapter(response, true);

    responseAdapter.setStatusCode(HttpServletResponse.SC_MOVED_TEMPORARILY);

    SAMLMessageContext<?, AuthnRequest, ?> context = makeSamlMessageContext();

    XMLObjectBuilderFactory builderFactory = Configuration.getBuilderFactory();

    SAMLObjectBuilder<Endpoint> endpointBuilder = (SAMLObjectBuilder<Endpoint>) builderFactory
            .getBuilder(AssertionConsumerService.DEFAULT_ELEMENT_NAME);

    Endpoint samlEndpoint = endpointBuilder.buildObject();
    samlEndpoint.setLocation(dao.loadString((this.getClass().getName() + "_IDPRedirectURL")));

    String uuid = UUIDBuilder.createUUID().toString();
    context.setRelayState(uuid);

    context.setPeerEntityEndpoint(samlEndpoint);
    context.setOutboundSAMLMessage(authnRequest);
    context.setOutboundMessageTransport(responseAdapter);

    HTTPRedirectDeflateEncoder httpRedirectDeflateEncoder = new HTTPRedirectDeflateEncoder();
    httpRedirectDeflateEncoder.encode((MessageContext) context);
}

我很难迁移它，因为库的这一部分似乎被重构了很多，但是，那里没有太多关于它的文档。 Message API Refactoring 给了我一些抽象信息，我无法真正应用到我的特定案例中，我也找不到任何合适的例子。有人可以在这项任务上给我任何支持吗？

Answer 1

我尝试调整您的 SAML 代码以使用 OpenSAML v3。希望这会有所帮助！

private void doAuthenticationRedirect(HttpServletRequest request, HttpServletResponse response) throws Exception {
  AuthnRequest authnRequest = buildAuthnRequestObject(); // assume this is your method

  // No response adapters needed anymore; the response now gets set directly on the encoder
  response.setStatus(HttpServletResponse.SC_MOVED_TEMPORARILY);

  // check your makeSamlMessageContext() method to see if any other properties on messageContext need to be set here
  MessageContext<SAMLObject> messageContext = new MessageContext<>();
  messageContext.setMessage(authnRequest);

  // This moved out of the Configuration class
  XMLObjectBuilderFactory builderFactory = XMLObjectProviderRegistrySupport.getBuilderFactory();

  SAMLObjectBuilder<Endpoint> endpointBuilder =
      (SAMLObjectBuilder<Endpoint>) builderFactory.getBuilder(AssertionConsumerService.DEFAULT_ELEMENT_NAME);

  Endpoint samlEndpoint = endpointBuilder.buildObject();
  samlEndpoint.setLocation(dao.loadString((this.getClass().getName() + "_IDPRedirectURL")));

  String uuid = UUIDBuilder.createUUID().toString(); // Assume this is your class

  // RelayState is now set via this helper method, or it can be performed via:
  // messageContext.getSubcontext(SAMLBindingContext.class, true).setRelayState(uuid);
  SAMLBindingSupport.setRelayState(messageContext, uuid);

  // Endpoint is now set via subcontexts
  SAMLPeerEntityContext peerEntityContext = messageContext.getSubcontext(SAMLPeerEntityContext.class, true);
  SAMLEndpointContext endpointContext = peerEntityContext.getSubcontext(SAMLEndpointContext.class, true);
  endpointContext.setEndpoint(samlEndpoint);

  // MessageContext and HttpServletResponse now get set directly on the encoder
  HTTPRedirectDeflateEncoder httpRedirectDeflateEncoder = new HTTPRedirectDeflateEncoder();
  httpRedirectDeflateEncoder.setMessageContext(messageContext);
  httpRedirectDeflateEncoder.setHttpServletResponse(response);
  httpRedirectDeflateEncoder.initialize();
  httpRedirectDeflateEncoder.encode();
}