Share on:

OpenAM and Spring Boot 3 Integration via SAMLv2 Protocol

Original article:


In the following article, we will set up OpenAM as an Identity Provider for a Spring Boot Application. In the previous article, we set up a Spring Boot application authentication via OpenAM with OAuth2/OIDC protocol. In the following article, we will set up authentication via OpenAM as an Identity Provider and Spring Boot application as a service provider using SAMLv2 protocol.

OpenAM Configuration

Create Hosted Identity Provider

If you have not installed OpenAM yet, you could run OpenAM as a Docker image. Let’s assume the OpenAM instance URL is

Go to the target realm and in the Common Tasks section. Open OpenAM console in a browser and press the Configure SAMLv2 Provider button.

Realm Common Tasks

Then press the Create Hosted Identity Provider button.

Realm Create Hosted Identity Provider

Select a Signing Key (for demonstration purposes we will use test), enter the Circle of Trust name, and then map user’s attributes to OpenAM. For demonstration the OpenAM users will be mapped by email.

Hosted Identity Provider Configuration

Press the Configure button.

Setup User Mapping in OpenAM

Open the administration console, goto desired realm, from the menu on the left. Select the applications section and navigate to SAML 2.0. In the Entity Providers list select On the Assertion Content tab, under NameID Format in the NameID Value Map list, add the element urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified=mail Press the Save button.

Create OpenAM Users

Open the administration console, goto desired realm, create a new user and fill the Email Address attribute

Spring Application Configuration

Create a new Spring Boot application and add the following Maven repositories and dependencies:

<!--security dependencies-->

Generate certificate and key files with the OpenSSL tool.

openssl req -newkey rsa:2048 -nodes -keyout rp-private.key -x509 -days 365 -out rp-certificate.crt

Put the generated files into src/main/resources/credentials directory.

Add the following settings to the application.yml file

  port: 8081
              - private-key-location: classpath:credentials/rp-private.key
                certificate-location: classpath:credentials/rp-certificate.crt
              binding: POST
              url: "{baseUrl}/logout/saml2/slo"

Create a controller and two endpoints: index and protected-saml. The index endpoint will be accessible for anyone and protected-saml endpoint will be accessible for authenticated with OpenAM users via SAMLv2 protocol.

public class SampleController {

    public String index() {
        return "index";

    public String samlProtected(Model model, @AuthenticationPrincipal Saml2AuthenticatedPrincipal principal) {
        String emailAddress = principal.getFirstAttribute("email");
        model.addAttribute("userName", emailAddress);
        model.addAttribute("method", "SAMLv2");
        return "protected";

Create the following templates for controllers:


<!DOCTYPE html><html>
<h1>OpenAM Spring Security Integration</h1>
<h2>Test Authentication</h2>
    <li><a href="/protected-saml">SAMLv2</li>


<!DOCTYPE html><html xmlns:th="">
<h1>Protected resource</h1>
<a href="/">Back</a></li>
<p><span th:text="${userName}"/> user authenticated with <span th:text="${method}"/></p>

Create Spring Security configuration

public class SecurityConfiguration {
    public SecurityFilterChain securitySamlFilterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests((authorize) -> authorize.requestMatchers("/")

Setup Service Provider in OpenAM

Run the Spring Boot Project to import the SAML metadata file of the Spring Boot project.

Open the OpenAM administration console, goto desired realm, click Configure SAMLv2 Provider in the Common Tasks section, then click Configure Remote Service Provider.

Set the metadata URL: http://localhost:8081/saml2/service-provider-metadata/openam and select the existing circle of trust created in the Create Hosted Identity Provider Step.

Remote Service Provider Config

Test the Solution

Logout form OpenAM if you are logged in.

Run the Spring application an open its URL in a browser: http://localhost:8081

Test App Index

Enter the user’s login and password and then press the LOG IN button.

OpenAM Authentication

After pressing the Log In button, you will be redirected to the Spring Security Application as an authenticated user.

Test App Authenticated