Support SAML SSO and normal login

问题

I have an application which is accessed by two types of users, internal and external. I need to authenticate external users using SAML.
I need to authenticate internal users with the normal form-based login. My application need to support both types of users. I use spring security frame work.

Is it possible to support both types of users? if so can you suggest the approach at high level? Thanks.

回答1:

You can easily enable support for both form and SAML authentication with configuration similar to this:

<http entry-point-ref="authenticationEntryPoint" authentication-manager-ref="authenticationManager">
    <intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY"/>
    <form-login login-page="/login" />
    <custom-filter before="FIRST" ref="metadataGeneratorFilter"/>
    <custom-filter after="BASIC_AUTH_FILTER" ref="samlFilter"/>
</http>

Make sure that your AuthenticationManager contains the samlAuthenticationProvider. And of course include other configuration parts from the Spring SAML sample application.

You can then create your custom login page which presents user with username+password fields for form-based authentication and a link/picture (or multiple of them) which initialize authentication with the IDP (by redirecting user to scheme://host:port/saml/login?idp=selectedIdpEntityId).

Your users then decide which one to use - depending on whether they's internal or external.

The part of Spring SAML documentation touching on this subject is in chapter Spring Security integration.

来源：https://stackoverflow.com/questions/23565557/support-saml-sso-and-normal-login