Package org.apache.juneau.rest.server.auth.saml

package org.apache.juneau.rest.server.auth.saml
SAML 2.0 assertion validation for the Juneau REST server, layered on the AuthFilter framework.

Wraps OpenSAML 5.x (org.opensaml:opensaml-*) behind a small, opinionated facade with strict security defaults. The OpenSAML dependencies are declared provided-scope in juneau-rest-server-saml's POM, so they never bleed into the dependency tree of an upstream module.

Key types
  • SamlAssertionValidator — validates a <samlp:Response> XML document and returns a ClaimsPrincipal marked with issuerType=SAML.
  • SamlAuthFilter — servlet filter that recognizes SAML responses delivered via HTTP POST or HTTP Redirect.
  • SamlBinding — enum identifying the SAML 2.0 transport binding the filter expects.
  • SamlMetadataResolvers — convenience factories that wrap OpenSAML's FilesystemMetadataResolver and DOMMetadataResolver.
Security defaults
  • Signature required — unsigned assertions are rejected.
  • Strict algorithm allowlist — only rsa-sha256 and ecdsa-sha256; SHA-1 is permanently rejected at the builder.
  • Clock skew — defaults to 60 seconds tolerance, capped at 5 minutes.
  • Audience restriction — the assertion's <AudienceRestriction> must list the SP entity ID configured on the validator.
  • Decryption — <EncryptedAssertion> requires an explicit decryptionCredential.
See Also:
Since:
10.0.0