Home

SpringBoot SAML2 sP notes

This is my notes on creating a SpringBoot webapp secured using SAML2

As a prereq, you will need a SAML IdP. You have some choices here... For production:

• Shibboleth IdP
• ADFS
• Azure AD
• Google Workspace ...others

For testing:

• shibboleth (again)
• https://samltest.id/

Being a Shib fan I'll include setup required for that. shib is about as complicated as it gets, everything else you should be able to seek inspiration from then notes here.

Steps:

• Set up a SpringBoot webapp with no authentication
• Add the SAML-y auth bits
• retrieving attributes
• filtering whether the authentication is accepted
• tweaking endpoints and metadata details