Integrating Spring Framework into CSSO

Some EDIT components like the Common Data Model(CDM) services, but also other projects meanwhile supporting CDM functionalities are implemented based on the Spring Framework": As the CDM services are central points of the EDIT infrastructure, they must be capable of being integrable with the Community Single Sign-On (CSSO) security infrastructure as well. Therefore, this document will summarise means to integrate SAML based SSO security aspects into the "Spring Framework": based on "Spring Security

Currently, there is only one way checked for integrating spring with CSSO

  • Spring Security SAML module

Spring Security SAML module

The Spring Security SAML module is a quite new development first published in February 2009. There is no more than source code": and a brief "documentation available, but the example application works well with the CSSO infrastructure based on OpenSSO. Using that module, we can support Spring based web applications or services.

Since, the installation of the example application is a bit tricky, the installation procedure on a Debian Etch system will be described in the following section.

Installation the Spring Security SAML module on Debian Etch

For the run of the library a Java EE 5 application server supporting Java Servlets 2.4 is required. In our scenario, we will use Tomcat6.

Please follow the instructions for SUN JDK5 Installation on Debian Etch andTomcat6 Installation on Debian Etch.

Next, download the Spring Security SAML module and extract it wherever you like (here /root/SpringSecuritySAML.

mkdir SpringSecuritySAML
unzip -d SpringSecuritySAML

Spring Security SAML makes use of the OpenSAML libraries. Therefore, some XML parsing libraries used by tomcat must be compatible with OpenSAML. For more details refer to

Compatibility can be achieved by adding the following jar-files to the Tomcat6 endorsed libraries (/opt/tomcat6/endorsed)

  • serializer-2.9.1.jar

  • xalan-2.7.1.jar

  • xercesImpl-2.9.1.jar

  • xml-apis-2.9.1.jar

You can simply use the jar-files included with the Spring Security SAML module,or retrieve more current versions on the Web. If not present, create the /opt/tomcat6/endorsed directory first.

mkdir /opt/tomcat6/endorsed
cp SpringSecuritySAML/saml2-webapp/target/spring-security-saml2-webapp/WEB-INF/lib/serializer-2.9.1.jar /opt/tomcat6/endorsed/
cp SpringSecuritySAML/saml2-webapp/target/spring-security-saml2-webapp/WEB-INF/lib/xalan-2.7.1.jar /opt/tomcat6/endorsed/
cp SpringSecuritySAML/saml2-webapp/target/spring-security-saml2-webapp/WEB-INF/lib/xercesImpl-2.9.1.jar /opt/tomcat6/endorsed/
cp SpringSecuritySAML/saml2-webapp/target/spring-security-saml2-webapp/WEB-INF/lib/xml-apis-2.9.1.jar /opt/tomcat6/endorsed/

The sample web application of Spring Security SAML uses JSTL 1.2 library. These libraries must be added to the Tomcat6 installation as well. The most recent version of the JSTL 1.2 library is included into [SUN Glassfish]( So, we need to download and unpack the latest release of Glassfish binaries) in order to get JSTL libraries. For more detailed information, please refer to

java -Xmx256m -jar glassfish-installer-v2.1-b60e-linux.jar
cd glassfish
chmod -R +x lib/ant/bin
lib/ant/bin/ant -f setup.xml 

Now, you can copy the glassfish/lib/javaee.jar to the Tomcat6 common libraries directory /opt/tomcat6/lib.

cp glassfish/lib/javaee.jar /opt/tomcat6/lib

Also, we'll need to copy glassfish/lib/appserver-jstl.jar to the directory of our web application (e.g. /opt/tomcat6/webapps/spring-security-saml2-webapp/WEB-INF/lib). Since, this is currently not deployed, remember this step for later, or copy it to SpringSecuritySAML/saml2-webapp/target/spring-security-saml2-webapp/WEB-INF/lib

cp glassfish/lib/appserver-jstl.jar SpringSecuritySAML/saml2-webapp/target/spring-security-saml2-webapp/WEB-INF/lib

After that, we describe the configuration of the webapplication, in order to get working with the EDIT-IdP running at

There is only one configuration file of the sample web application located at saml2-webapp/src/main/resources/security/securityContext.xml.

First, you will require a private key and include it within a JKS keystore. I would recommend the IBM KeyMan": to manage your keystores, particularly if you already have a certificateand key for you server. You may also follow this "description Do not forget to give your key a name (alias) ! (e.g.

Second, you have to configure the webapps security-context.xml with you private keystore. Therefore, you have to provide the beans keyStore*, *keyResolver and webSSOprofile with your keystore file (e.g. classpath:security/*) and password (e.g. *secret_pw or the key alias within your key store (e.g. The classpath::security thing reflect the WEB-INF/classes/security directory in your web application.

    <!-- Key manager, set the JKS path and password to open the datastore -->
    <bean id="keyStore" class="">
        <constructor-arg index="0" value="classpath:security/" />
        <constructor-arg index="1" value="secret_pw" />

    <!-- Set keys which should be available to the system in the map, one of these keys must be also 
         specified in the webSSOProfile later -->
    <bean id="keyResolver" class="">
        <constructor-arg index="0">
            <bean factory-bean="keyStore" factory-method="getKeyStore" />
        <constructor-arg index="1">
                <entry key="" value="secret_pw" />

    <!-- Entry point to initialize authentication -->    
    <bean id="webSSOprofile" class="" depends-on="bootstrap">
        <constructor-arg index="0" ref="metadata" />
        <constructor-arg index="1" ref="keyResolver" />
        <!-- The name of key to use for encryption/signing purposes must be set here -->
        <constructor-arg index="2" value="" />
        <property name="protocolCache" ref="protocolCache" />
        <property name="parser" ref="parserPool" />

The next step concerns the metadata configuration. The EDIT-IdP provides a URL, where clients can get the metadata of the federation( So, you do not need to grab and store the metadata using the bean class FilesystemMetadataProvider and must comment this bean. The bean class HTTPMetadataProvider will do anything you need, so just enter the metadata-URL of the EDIT-IdP into constructor arg 0. Since, we have only one EDIT-IdP currently, you should state its URL as defaultIDP (

    <!-- IDP Metadata configuration - paths to metadata of IDPs in circle of trust is here -->
    <!-- Do no forget to call iniitalize method on providers -->
    <bean id="metadata" class="" depends-on="bootstrap">
        <constructor-arg index="0">
                <bean class="org.opensaml.saml2.metadata.provider.HTTPMetadataProvider" init-method="initialize">
                    <!-- URL containing the metadata -->
                    <constructor-arg index="0">
                        <value type="java.lang.String"></value>
                    <!-- Timeout for metadata loading in ms -->
                    <constructor-arg index="1">
                        <value type="int">5000</value>
                    <property name="parserPool" ref="parserPool"/>
        <!-- OPTIONAL property: can tell the system which IDP should be used for authenticating user by default. -->
        <property name="defaultIDP" value=""/>

After this, you must provide the EDIT CA certificates to your Java installation. These are needed due to the SSL-verification of the connection. The EDIT WP 5.7 Certificate Authority provides a ready to use attachment:EDIT-WP5.7-Truststore.jks". You can provide these certificates by simply overwriting the default jre/lib/security/cacerts file of you java installation with the attachment:"EDIT-WP5.7-Truststore.jks". Or, you can use the Java keytool application or "IBM KeyMan to modify or create your own Java truststore. The EDIT WP 5.7 Certificate Authority published all issued certificates on its page.

Next, you should contact the EDIT-IdP manager (me), that you want get part of the EDIT federation, and submit your certificate to him. He will have to add you to the federation on the IdP, or manage a test account for your application.

Now, we can proceed compiling and deploying the sample web application. This step requires Apache Maven So, please refer to Apache Maven 2 Installation on Debian Etch.

Step into the directory where you unpacked SpringSecuritySAML, run Maven and cp the resulting war file to Tomcat's web application directory.

cd SpringSecuritySAML
mvn package
cp saml2-webapp/target/spring-security-saml2-webapp.war /opt/tomcat6/webapps/

Start tomcat, and check the Tomcat6 log files (/opt/tomcat6/logs) if the sample application deploys well.

Before being capable to test the SSO functionality, you need to make the application SSL-capable. I am not an expert in Tomcat6, so I recommend using Apache2 to do this. Therefore, install Apache and enable the following modules.

apt-get install apache2
a2enmod ssl
a2enmod proxy
a2enmod proxy_http
a2enmod proxy_ajp

Create a file /etc/apache2/sites-available/ and adopt it to your needs. Have a particular look at anything which contains This will probably need to be adopted.

Listen 443

# Please replace '' with your host name !
  SSLEngine               on
  SSLCertificateFile      /etc/ssl/certs/
  SSLCertificateKeyFile   /etc/ssl/private/

  <Location /spring-security-saml2-webapp>
        Allow from all
        ProxyPass ajp://localhost:8009/spring-security-saml2-webapp
        ProxyPassReverse ajp://localhost:8009/spring-security-saml2-webapp
        ProxyPassReverseCookiePath  ajp://localhost:8009/spring-security-saml2-webapp /spring-security-saml2-webapp
        ProxyPassReverseCookieDomain  ajp://localhost:8009/spring-security-saml2-webapp


Check your Tomcat /opt/tomcat6/conf/server.xml configuration file. It should contain the following lines configuring the AJP connector used by the Apache proxy module.

    <!-- Define an AJP 1.3 Connector on port 8009 -->
    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
                enableLookups="false" redirectPort="8443" protocol="AJP/1.3"
                request.tomcatAuthentication="false" address="" />


If everything is fine, restart tomcat and apache, and try to access the sample web application (e.g.

/etc/init.d/tomcat6 restart
/etc/init.d/apache2 restart

You should be redirected to the EDIT-IdP and login there (Of course, you'll need to be registered there). After succesfully being logged in, you should see a page with your EDIT-IdP attributes.

Add picture from clipboard (Maximum size: 40 MB)