身份联邦#

public class MetadataVerifier {
    
    /**
     * 验证元数据签名
     */
    public boolean verifyMetadataSignature(
            String metadataXml, 
            X509Certificate signingCertificate) {
        
        try {
            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
            dbf.setNamespaceAware(true);
            Document doc = dbf.newDocumentBuilder().parse(
                new InputSource(new StringReader(metadataXml)));
            
            NodeList signatureNodes = doc.getElementsByTagNameNS(
                "http://www.w3.org/2000/09/xmldsig#", "Signature");
            
            if (signatureNodes.getLength() == 0) {
                return false; // 元数据必须有签名
            }
            
            DOMValidateContext valContext = new DOMValidateContext(
                signingCertificate.getPublicKey(), 
                signatureNodes.item(0));
            
            XMLSignature signature = XMLSignatureFactory.unmarshalDOMSignature(
                (Element) signatureNodes.item(0));
            
            return signature.validate(valContext);
        } catch (Exception e) {
            log.error("元数据签名验证失败", e);
            return false;
        }
    }
}

@Service
@Slf4j
public class DiscoveryService {
    
    private final Map<String, String> domainToIdpMapping = new ConcurrentHashMap<>();
    
    /**
     * 根据邮箱域名查找 IdP
     */
    public Optional<String> findIdpByEmail(String email) {
        String domain = email.substring(email.indexOf('@') + 1);
        return Optional.ofNullable(domainToIdpMapping.get(domain));
    }
    
    /**
     * 构建 Discovery 响应 URL
     * 返回用户应该重定向到的 IdP
     */
    public String buildIdpRedirectUrl(String email) {
        return findIdpByEmail(email)
            .map(idpUrl -> idpUrl + "/sso?return_url=" + returnUrl)
            .orElseThrow(() -> new IdpNotFoundException("找不到 IdP: " + email));
    }
    
    /**
     * 注册域名到 IdP 的映射
     */
    public void registerDomainMapping(String domain, String idpUrl) {
        domainToIdpMapping.put(domain.toLowerCase(), idpUrl);
        log.info("注册域名映射: {} -> {}", domain, idpUrl);
    }
}

@Configuration
public class AttributeMapper {
    
    @Bean
    public AttributeMappingRegistry attributeMappingRegistry() {
        AttributeMappingRegistry registry = new AttributeMappingRegistry();
        
        // SAML 到标准属性的映射
        registry.registerSamlMapping("urn:oid:0.9.2342.19200300.100.1.1", "uid");
        registry.registerSamlMapping("urn:oid:0.9.2342.19200300.100.1.3", "email");
        registry.registerSamlMapping("urn:oid:2.16.840.1.113730.3.1.241", "displayName");
        registry.registerSamlMapping("urn:oid:1.3.6.1.4.1.5923.1.5.12.1", "groups");
        
        // OIDC 到标准属性的映射
        registry.registerOidcMapping("sub", "uid");
        registry.registerOidcMapping("email", "email");
        registry.registerOidcMapping("name", "displayName");
        registry.registerOidcMapping("groups", "groups");
        
        return registry;
    }
    
    /**
     * 映射用户属性
     */
    public FederationUser mapAttributes(
            Map<String, Object> rawAttributes,
            FederationType type) {
        
        FederationUser user = new FederationUser();
        
        Map<String, Object> standardAttrs = attributeMappingRegistry()
            .mapToStandard(rawAttributes, type);
        
        user.setUid(standardAttrs.get("uid").toString());
        user.setEmail(standardAttrs.get("email").toString());
        user.setDisplayName(standardAttrs.getOrDefault("displayName", "").toString());
        user.setGroups(mapGroups(standardAttrs.getOrDefault("groups", Collections.emptyList())));
        
        return user;
    }
}

@Component
public class JitProvisioningFilter extends OncePerRequestFilter {
    
    @Autowired
    private UserRepository userRepository;
    
    @Autowired
    private AttributeMapper attributeMapper;
    
    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                     HttpServletResponse response,
                                     FilterChain filterChain) 
            throws ServletException, IOException {
        
        // 从 SAML/OIDC 响应中提取用户属性
        FederationUser fedUser = extractFederationUser(request);
        
        if (fedUser != null) {
            User localUser = userRepository.findByExternalId(fedUser.getUid())
                .orElseGet(() -> createUser(fedUser));
            
            // 更新属性（如果 IdP 中的信息变了）
            updateUserAttributes(localUser, fedUser);
            
            // 将本地用户设置到安全上下文中
            SecurityContextHolder.getContext().setAuthentication(
                new FederatedUserAuthentication(localUser));
        }
        
        filterChain.doFilter(request, response);
    }
    
    private User createUser(FederationUser fedUser) {
        User user = new User();
        user.setExternalId(fedUser.getUid()); // 关联到联邦 ID
        user.setEmail(fedUser.getEmail());
        user.setDisplayName(fedUser.getDisplayName());
        user.setEnabled(true);
        
        // 默认角色
        user.setRoles(Collections.singletonList("USER"));
        
        return userRepository.save(user);
    }
}

@Configuration
public class FederationHubConfig {
    
    /**
     * 定义联邦成员
     */
    @Bean
    public FederationMemberRegistry federationMemberRegistry() {
        FederationMemberRegistry registry = new FederationMemberRegistry();
        
        registry.registerMember(FederationMember.builder()
            .entityId("https://partner-a.com/saml")
            .name("合作伙伴 A")
            .metadataUrl("https://partner-a.com/metadata.xml")
            .trustLevel(TrustLevel.STRATEGIC)
            .attributeReleasePolicy(releaseAllPolicy())
            .build());
        
        registry.registerMember(FederationMember.builder()
            .entityId("https://partner-b.com/saml")
            .name("合作伙伴 B")
            .metadataUrl("https://partner-b.com/metadata.xml")
            .trustLevel(TrustLevel.VERIFIED)
            .attributeReleasePolicy(restrictedPolicy())
            .build());
        
        return registry;
    }
    
    /**
     * 属性发布策略
     */
    private AttributeReleasePolicy releaseAllPolicy() {
        return new SelectiveAttributeReleasePolicy(List.of(
            "uid", "email", "displayName", "groups"
        ));
    }
    
    private AttributeReleasePolicy restrictedPolicy() {
        return new SelectiveAttributeReleasePolicy(List.of(
            "uid", "email"
        ));
    }
}

@Service
@Slf4j
public class EnterpriseIdPIntegration {
    
    @Autowired
    private KeycloakClient keycloakClient;
    
    /**
     * 配置企业 SAML Federation
     */
    public void configureSamlFederation(String idpMetadataUrl, 
                                         String spEntityId) {
        try {
            // 获取 IdP 元数据
            IDPSSODescriptor idpDescriptor = fetchAndParseIdPMetadata(idpMetadataUrl);
            
            // 验证元数据签名
            if (!verifyMetadataSignature(idpDescriptor)) {
                throw new SecurityException("IdP 元数据签名验证失败");
            }
            
            // 创建或更新 SAML IdP 配置
            keycloakClient.importIdentityProvider(
                IdentityProviderRepresentation.builder()
                    .alias(extractAlias(idpDescriptor))
                    .displayName(idpDescriptor.getOrganization().getDisplayName())
                    .providerId("saml")
                    .config(Map.of(
                        "idpMetadata", idpMetadataUrl,
                        "spEntityId", spEntityId,
                        "wantAssertionsSigned", "true",
                        "signatureAlgorithm", "RSA_SHA256"
                    ))
                    .build()
            );
            
            log.info("成功配置企业 SAML Federation: {}", idpDescriptor.getEntityID());
        } catch (Exception e) {
            log.error("配置 SAML Federation 失败", e);
            throw new RuntimeException("联邦配置失败", e);
        }
    }
    
    /**
     * 配置企业 OIDC Federation
     */
    public void configureOidcFederation(String issuerUrl) {
        // OIDC 通过自动发现简化配置
        keycloakClient.importIdentityProvider(
            IdentityProviderRepresentation.builder()
                .alias(extractHost(issuerUrl))
                .displayName("Enterprise OIDC")
                .providerId("oidc")
                .config(Map.of(
                    "issuer", issuerUrl,
                    "clientAuthMethod", "client_secret_post",
                    "syncMode", "IMPORT"
                ))
                .build()
        );
    }
}

@Component
@Slf4j
public class CertificateLifecycleManager {
    
    /**
     * 监听证书更新事件
     */
    @EventListener
    public void onMetadataUpdated(MetadataUpdatedEvent event) {
        String entityId = event.getEntityId();
        log.info("检测到元数据更新: {}", entityId);
        
        // 重新加载元数据
        IdentityProvider idp = loadIdentityProvider(entityId);
        
        // 验证新证书
        List<X509Certificate> newCerts = extractCertificates(idp.getMetadata());
        for (X509Certificate cert : newCerts) {
            if (!validateCertificate(cert)) {
                log.error("新证书验证失败: entity={}, cert={}", 
                    entityId, cert.getSubjectX500Principal());
                alertSecurityTeam(entityId, cert);
            }
        }
        
        // 平滑切换到新证书
        scheduleCertificateRotation(entityId, newCerts);
    }
    
    /**
     * 证书切换策略
     * 新旧证书共存一段时间，确保平稳过渡
     */
    private void scheduleCertificateRotation(String entityId, 
            List<X509Certificate> newCerts) {
        Instant switchTime = Instant.now().plus(24, ChronoUnit.HOURS);
        
        scheduledTasks.schedule(entityId, switchTime, () -> {
            updateIdentityProviderCertificates(entityId, newCerts);
            log.info("证书已更新: {}", entityId);
        });
    }
}