spring-projects / spring-projects/spring-security
Add support for HSM
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Many applications will not deal with keys at all but will instead send data to a service like Vault to be encrypted, decrypted, signed, and verified.
Currently, an application needs to implement their own Saml2AuthenticationRequestFactory and AuthenticationProvider to achieve this. It would be nice if applications could implement something more targeted to cryptographic operations.
- Decrypting Assertions - https://github.com/spring-projects/spring-security/issues/9044
- Signing AuthnRequests - https://github.com/spring-projects/spring-security/issues/9045
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the existing Saml2AuthenticationRequestFactory and AuthenticationProvider responsibilities, then read issue 9045 about signing AuthnRequests. Done means applications can target cryptographic operations through a supported HSM or Vault-style service without implementing both existing components themselves.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100