How to avoid login page with Spring Ssecurity and SAML? - spring-boot

Question

I am trying that when a user logs into my system via Saml2, it automatically redirects him to the associated configuration based on his domain, without having to go through the login page like the one shown.
For example the user: user1#company1.com, I would like to be automatically redirected to the authentication page corresponding to the domain (company1 > singlesignon.url), without having to go through this intermediate.
I have tried to solve this using Saml2SecurityConfig, but I don't know how I have to set up it right.
How could it be done?
security:
saml2:
relyingparty:
registration:
company1:
identityprovider:
entity-id:
verification.credentials:
- certificate-location:
singlesignon.url: https://login.microsoftonline.com/XXXX/saml2
singlesignon.sign-request:
company2:
identityprovider:
entity-id:
verification.credentials:
- certificate-location:
singlesignon.url:
singlesignon.sign-request:
Saml2Config
public class Saml2Config extends WebSecurityConfigurerAdapter {
#Override
protected void configure(HttpSecurity http) throws Exception {
OpenSamlAuthenticationProvider authenticationProvider = new OpenSamlAuthenticationProvider();
authenticationProvider.setResponseAuthenticationConverter(responseToken -> {
Saml2Authentication authentication = OpenSamlAuthenticationProvider
.createDefaultResponseAuthenticationConverter()
.convert(responseToken);
Assertion assertion = responseToken.getResponse().getAssertions().get(0);
String username = assertion.getSubject().getNameID().getValue();
UserDetails userDetails = inMemoryUserDetailsManager().loadUserByUsername(username);
authentication.setDetails(userDetails);
return authentication;
});
http
.requestMatchers()
.antMatchers("/login/**","/saml2/**")
.and()
.authorizeRequests()
.anyRequest().authenticated()
.and()
.saml2Login().authenticationManager(new ProviderManager(authenticationProvider))
.and().csrf().disable();
}
}

Answer 1

I generally see organizations disambiguate their partners via the user's email address (like how the Office 365 Portal does it) or via a customer-specific FQDN (e.g., customer.service.com) similar to how Salesforce does it with their "My Domain" configuration.
If you use email address, then you should put that into the Subject of the AuthnRequest so that the IdP can use that in the login screen.