扩展WebSphere SAML

// 验证SAML断言签名
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setNamespaceAware(true);
DocumentBuilder builder = dbf.newDocumentBuilder();
Document doc = builder.parse(new ByteArrayInputStream(samlAssertion.getBytes()));

// 使用OpenSAML验证签名
BasicParserPool parserPool = new BasicParserPool();
parserPool.initialize();
SAMLDocumentHolder samlDocumentHolder = new SAMLDocumentHolder(doc);
XMLSignature signature = (XMLSignature) Configuration.getGlobalSecurityConfiguration().getSignatureValidator().validate(samlDocumentHolder);

if (signature.verify()) {
    System.out.println("SAML断言验证成功");
} else {
    System.out.println("SAML断言验证失败");
}

<!-- WebSphere SAML配置示例 -->
<security-constraint>
    <web-resource-collection>
        <web-resource-name>SAML Protected Resources</web-resource-name>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>user</role-name>
    </auth-constraint>
</security-constraint>

<saml-sso-config>
    <saml-issuer>https://idp.example.com</saml-issuer>
    <saml-assertion-consumer-service-url>https://sp.example.com/saml/acs</saml-assertion-consumer-service-url>
    <saml-identity-provider-metadata-url>https://idp.example.com/metadata</saml-identity-provider-metadata-url>
</saml-sso-config>