Nsryjdtyk

I'm trying to use Okta to authenticate users from a SpringBoot application.

I've setup the app following the Okta Tutorial from : https://developer.okta.com/blog/2017/03/16/spring-boot-saml

However my app is behind an ELB, and as such the TLS is being terminated at the LB. So I've modified the configuration from the tutorial to suit my needs.

 @Override

protected void configure(final HttpSecurity http) throws Exception {

    http

        .authorizeRequests()

            .antMatchers("/saml*").permitAll()

            .anyRequest().authenticated()

            .and()

        .apply(saml())

            .serviceProvider()

                .keyStore()

                    .storeFilePath(this.keyStoreFilePath)

                    .password(this.password)

                    .keyname(this.keyAlias)

                    .keyPassword(this.password)

                    .and()

                .protocol("https")

                .hostname(String.format("%s", serverName))

                .basePath("/")

                .and()

            .identityProvider()

            .metadataFilePath(this.metadataUrl);

}

This does the trick but there is a problem. After the user is authenticated by Okta, the user is finally redirected to a http URL instead of a https URL. I am thinking the reason for this is that the TLS is being terminated at the LB and my app is actually receiving the request with http which is being sent in the RelayState.

This is something I found : spring-boot-security-saml-config-options.md.
It contains a list of SAML properties for spring boot security. I added the following to the application.properties file

saml.sso.context-provider.lb.enabled = true

saml.sso.context-provider.lb.scheme=https

saml.sso.profile-options.relay-state=<https://my.website.com>

It doesn't change the http redirection. Is there something I am doing wrong?

When a SAML 2.0 IdP like Okta redirects back to you application the endpoint url is either based on the SAML 2.0 metadata you application expose or the configuration in the IdP.

Furthermore, it is optional to add a Destination property in SAML 2.0 AuthnRequest:

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified" 

    Destination="https://my.website.com" IssueInstant="2018-11-22T09:23:08.844Z" Version="2.0" ID="id-f8ee3ab1-6745-42d5-b00f-7845b97fe953">

<Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion"> ... </Issuer>

...

</samlp:AuthnRequest>