title: Spring Security SAML with Spring session
body: <p>I am using OpenAM as my IDP and my SP (an angular2 SPA) is based on the example shared at: <a href="https://github.com/vdenotaris/spring-boot-security-saml-sample" rel="noreferrer">https://github.com/vdenotaris/spring-boot-security-saml-sample</a></p>
  
  <p>After authentication, my webapp is supposed to invoke few REST services which are secured via http-basic authentication(using spring security) whose sessions are managed via <a href="http://projects.spring.io/spring-session/" rel="noreferrer">Spring Session</a>.</p>
  
  <p>I am trying to create spring-session based sessions after a user is authenticated through OpenAM IDP. My intent is to use these sessions to talk to my http-basic-secured REST services. </p>
  
  <p>Following is the "configure()" of my webapp's WebSecurityConfig before I attempted integrating spring-session with spring-saml and this works just fine.</p>
  
  <pre><code>@Override  
  protected void configure(HttpSecurity http) throws Exception {
      http
      .httpBasic()
      .authenticationEntryPoint(samlEntryPoint());
      http
      .csrf()
      .disable();
      http
      .addFilterBefore(metadataGeneratorFilter(), ChannelProcessingFilter.class)
      .addFilterAfter(samlFilter(), BasicAuthenticationFilter.class);
      http        
      .authorizeRequests()
      .antMatchers("/").permitAll()
      .antMatchers("/publicUrl").permitAll()
      .antMatchers("/app/**").permitAll()
      .antMatchers("/error").permitAll()
      .antMatchers("/saml/**").permitAll()
      .anyRequest().authenticated();  
      http
      .logout()
      .logoutSuccessUrl("/");
  
  }
  </code></pre>
  
  <p>And the authentication works just fine. In the POST fired from IDP (OpenAM) I can see the cookie being set properly. eg : Set-Cookie:  JSESSIONID=8DD6CDBF8079E83C8F4E7976C970BB27; Path=/; HttpOnly</p>
  
  <pre><code>Response
      Headers
          Pragma:  no-cache
          Date:  Sun, 31 Jul 2016 02:12:06 GMT
          X-Content-Type-Options:  nosniff
          Server:  Apache-Coyote/1.1
          X-Frame-Options:  DENY
          Location:  http://localhost:8097/
          Cache-Control:  no-cache, no-store, max-age=0, must-revalidate
          Set-Cookie:  JSESSIONID=8DD6CDBF8079E83C8F4E7976C970BB27; Path=/; HttpOnly
          Content-Length:  0
          X-XSS-Protection:  1; mode=block
          Expires:  0
      Cookies
          JSESSIONID:  8DD6CDBF8079E83C8F4E7976C970BB27
  </code></pre>
  
  <p>Following is the "configure()" of my webapp's WebSecurityConfig after I tried integrating spring-session with spring-saml and this breaks the authentication.</p>
  
  <pre><code>@Override  
  protected void configure(HttpSecurity http) throws Exception {
      http
      .httpBasic()
      .authenticationEntryPoint(samlEntryPoint());
      http
      .csrf()
      .disable();
      http
      .addFilterBefore(metadataGeneratorFilter(), ChannelProcessingFilter.class)
      .addFilterAfter(samlFilter(), BasicAuthenticationFilter.class);
      http        
      .authorizeRequests()
      .antMatchers("/").permitAll()
      .antMatchers("/publicUrl").permitAll()
      .antMatchers("/app/**").permitAll()
      .antMatchers("/error").permitAll()
      .antMatchers("/saml/**").permitAll()
      .anyRequest().authenticated();  
      http
      .logout()
      .logoutSuccessUrl("/");
  
      http
      .addFilterBefore(sessionRepositoryFilter(sessionRepository(), httpSessionStrategy()),
              ChannelProcessingFilter.class)
      .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);
  
  }
  </code></pre>
  
  <p>In the POST fired back from IDP (OpenAM) I dont see the cookie being set.</p>
  
  <pre><code>Response
      Headers
          Pragma:  no-cache
          Date:  Sun, 31 Jul 2016 02:18:44 GMT
          X-Content-Type-Options:  nosniff
          Server:  Apache-Coyote/1.1
          X-Frame-Options:  DENY
          Location:  http://localhost:8097/
          Cache-Control:  no-cache, no-store, max-age=0, must-revalidate
          x-auth-token:  666412f1-b293-49fa-bacb-0aa6fc3d2fe0
          Content-Length:  0
          X-XSS-Protection:  1; mode=block
          Expires:  0
      Cookies
  </code></pre>
  
  <p>The SAML response was ok as I can see the Subjects details from IDP post authentication.</p>
  
  <p>snippet from the SAML response</p>
  
  <pre><code>    &lt;saml:Subject&gt;
          &lt;saml:NameID 
              Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" 
              NameQualifier="http://openam.example.com:8080/OpenAM-13.0.0"&gt;vin@example.com
          &lt;/saml:NameID&gt;
          &lt;saml:SubjectConfirmation 
              Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"&gt;
              &lt;saml:SubjectConfirmationData 
                  InResponseTo="a1f07e22gi7db1h425hfj65i5gh0464" 
                  NotOnOrAfter="2016-07-31T02:28:44Z" 
                  Recipient="http://localhost:8097/saml/SSO"/&gt;
          &lt;/saml:SubjectConfirmation&gt;
      &lt;/saml:Subject&gt;
  </code></pre>
  
  <p>Since the cookie is not set, I am not able to get hold of the principal object. My UI assumes the user is not authenticated and redirects the user again to IDP and it keeps running in a loop.</p>
  
  <p>Your response is highly appreciated.</p>