Spring Security SAML: Display SAML Token on Error Page - spring-security

Question

I've built a SAML SP based on this project: https://github.com/vdenotaris/spring-boot-security-saml-sample and would like to display the SAML token on the error page for debugging purposes.
I've added an error controller
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;
import javax.servlet.http.HttpServletRequest;
#Controller
public class ErrorController implements org.springframework.boot.autoconfigure.web.ErrorController {
private static final Logger log = LoggerFactory.getLogger(SSOController.class);
private static final String PATH = "/error";
#RequestMapping(value = PATH)
public String error(HttpServletRequest request, Model model, Exception exception) {
model.addAttribute(exception);
return "error";
}
#Override
public String getErrorPath() {
return PATH;
}
}
I'm testing it with bad requests, but the Exception doesn't contain much helpful info. I would like to display the SAML token on the error page or at least in the logs for troubleshooting purposes.
How can I get access to the SAML token or at least the attributes that of the SAML token.
Thanks in advance.
Also, is there a way to manufacture the same SAML token using Postman (or a similar tool) to make testing easier. Right now, I'm deploying to AWS everytime because the third part IdP is not configured to handle localhost.
Thanks again.

Answer 1

To show/access SAML assertion(SAML assertion is part of SAML response) anywhere in your application (of course after successfull
authentication), you can use following code.
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
SAMLCredential credential = (SAMLCredential) authentication.getCredentials();
System.out.println("assertion is:" + XMLHelper.nodeToString(SAMLUtil.marshallMessage(credential.getAuthenticationAssertion())))
If you want to print theSAMl response in the logs you can set the logging level of spring-security to debug and spring will print SAML response in the log.
is there a way to manufacture the same SAML token using Postman
No. To get SAML assertion you have to follow the complete flow. Also you can not generate the SAML response by yourself because you can not sign it with same private key as of IDP. It also depends on your IDP if it supports such feature. What you can do is configure IDP to generate SAML token with really long expiration time say 24 hrs. Then you can use same SAML token for testing in your local application.