带有 OKTA 的 Spring SAML SSO - 更改 Web 应用程序上下文时的 InResponseTo

Question

We're having a lot of trouble with OKTA SAML SSO integration with Spring Security. We're using the saml-dsl extension to Spring Security to configure the auth, and everything works fine on HTTP, however when we try to use HTTPS the authentication only works when the app is deployed on root ( / ) context. When we change the context to anything else, it stops working and starts throwing InResponseTo field errors and sometimes with different configurations it comes to a redirect loop.

Here's the configuration we're using:

        http
                .csrf()
                .disable();
        http
                .sessionManagement().sessionFixation().none();
        http
                .logout()
                .logoutSuccessUrl("/");
        http
                .authorizeRequests()
                .antMatchers("/saml*").permitAll()
                .anyRequest().authenticated()
                .and()
                .apply(samlConfigurer())
                .serviceProvider()
                .keyStore()
                .storeFilePath(config.getKeystorePath())
                .password(config.getKeystorePassword())
                .keyname(config.getKeyAlias())
                .keyPassword(config.getKeystorePassword())
                .and()
                .protocol("https")
                .hostname(String.format("%s:%s", serverURL, config.getServerPort()))
                .basePath("/"+contextRoot)
                .and()
                .identityProvider()
                .metadataFilePath(config.getMetadataUrl());

And we should have our OKTA setup properly as well ( https://localhost:8443/ourappcontext/saml/SSO for testing, all the other stuff too )

We've tried most of the solutions proposed on here and the Spring documentation ( empty factory, spring session management and session fixation and so on ) and nothing seems to work. Are we doing something wrong? We're currently not generation any SP metadata, could it be that this is at fault and the request is somehow redirected to the wrong place or something? Really confused as of right now, first time using SAML and I'm not sure if it's the extension, the OKTA config or the Spring config...

We're deploying on Wildfly and you set the application context on there through a separate jboss-web.xml, if that matters at all.

Answer 1

By default the HttpSessionStorageFactory is used and this provides HttpSessionStorage SAML message store.

--> The HTTP session cookie is the browser side key to the server side SAML message store.

When the HTTP session cookie is not sent by the browser when the SAML response is delivered to Spring Security SAML SP, it can not find the related SAML AuthNRequest and fails to compare 'InResponseTo' value with 'ID' value of matching AuthNRequest.

If you can not assure HTTP session cookie is delivered you may implement your own SAMLMessageStorageFactory and SAMLMessageStorage (as I did).