Configure a Proxy for Legacy Spring Security SAML Metadata Downloads

A legacy Spring Security SAML application can fetch identity-provider metadata from the server process using HTTPMetadataProvider. That outbound download uses the HTTP client supplied to the metadata provider.

For an application using the Spring Security SAML 1.0.x/OpenSAML 2 configuration style, configure its Apache Commons HttpClient before injecting it:

org.apache.commons.httpclient.HttpClient metadataHttpClient =
    new org.apache.commons.httpclient.HttpClient();
metadataHttpClient.getHostConfiguration()
    .setProxy("proxy.example", 8080);

Pass that configured object as the HTTP client constructor argument of org.opensaml.saml2.metadata.provider.HTTPMetadataProvider, alongside the existing timer and metadata URL. In an XML configuration, the referenced client bean must be this configured instance.

Retain the provider’s existing parser pool, refresh configuration and surrounding metadata manager. Changing the route does not replace those responsibilities.

The metadata URL remains the identity provider’s URL. The proxy host belongs on the HTTP client. For an approved publicly reachable metadata URL, an HTTP candidate from the HTTP proxy list can fill that client’s host and port when public intermediaries are allowed and no proxy credentials are retained. This is a server-side retrieval path: a successful browser redirect to the identity provider does not show that the application server can download or refresh metadata through its own network restrictions.

Use this configuration only for the legacy classes named here. Modern Spring Security saml2 support uses another API, and a bean written for the old extension is not interchangeable with its current metadata configuration.