How to capture an incoming SSO SAML token in Vaadin 23

Flow
1

Hey all,

I’m progressing with my upgrade of my Vaadin 14 application to Vaadin 23, on the road to Vaadin 24.

In the older version, I have support for SSO sign on, where the SAML token is submitted to the application as a request parameter.
I used to be able to pull this request out as the UI was being instantiated and allocate it to a Session attribute, and then avoid login display, instead forwarding to the SAML processing functionality for authentication.

I’ve been trying to get this working in the new Vaadin 23 world, but have been having issues finding how to intercept that inbound request now.

I tried implementing a BeforeEventObserver on the main layout of the application (defined as the Route(“”) for the application. It is what decides whether to show the login page, or forward to the application proper if pre-existing authentication is found).

Querying the Parameter map at this point shows no sign of the incoming token.

I previously tried to having someting similar in a VaadinServiceInitListener, inside the UI Init listener, but it also was not finding the parameter there.

Would anyone be able to advise where I would be able to find this?

The situation for my application is that the SSO IdP sends a simple POST form to the application URL, with the encoded token in a named parameter.

Thanks.

Update:
I ended up finding this issue report that sounded similar.

Where the resolution is to set the Maven production goal to eager server load in order to forward on the paramters coming in.

This worked, so now I see the HTTP request inbound contains the token I need.

Of course turning on this means the application now hangs and doesn’t load any page Login or otherwise. But I’ll keep looking at that. This may have been a step forward.

2

Getting the saml token in the Vaadin view seems a bit counter intuitive to me.

Spring Security has saml support and uses a filter. https://www.baeldung.com/spring-security-saml

3

And if your application isn’t using Spring, I suggest to move the SAML handling to a servlet filter or a Vaadin RequestHandler

1 Like
4

Thanks for your response,

Yes, I used to do it like that under Vaadin 14, but after upgrading to Vaadin 23 it no longer functioned.
So I’ve been trying to figure out where best to place the initial ‘grab’ of the parameter to then make it available to progress the login.

I am going to have to figure it out, as I need to revert that eager setting, the rest of the application no longer functions with that in place.

As to the other replier, I do not use Spring.
This application has over it’s lifetime been working with Vaadin 6 → 7 → 14 and now looking at moving to 24.

5

Just an update. Thanks for the input again.
Adding a request handler in my v23 VaadinServiceInitListener was a big help.

I wouldn’t have come across that without your offhand suggestion, so thanks for that.

I can see it is getting access to the token at least now, so just need to tweak some things after.

Big help, thanks!!

1 Like