and re-initializes the underlying
+ * handler.
+ *
+ * @throws UncheckedIOException if the backup operation fails
+ */
+ private void backupFile() throws UncheckedIOException {
+ try {
+ this.flush();
+ this.close();
+
+ final String dateString = dateFormatter.format(this.lastModified);
+ final String path = this.logFile.toString();
+ final String extension = FilenameUtils.getExtension(path);
+ final String backupPath = StringUtils.hasText(extension)
+ ? String.format("%s-%s.%s",
+ path.substring(0, path.length() - extension.length() - 1), dateString, extension)
+ : String.format("%s-%s", path, dateString);
+
+ Files.move(this.logFile, Path.of(backupPath), StandardCopyOption.REPLACE_EXISTING);
+ this.lastModified = null;
+ this.initializeHandler();
+ }
+ catch (final IOException e) {
+ throw new UncheckedIOException(e.getMessage(), e);
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public synchronized void flush() {
+ this.handler.flush();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public synchronized void close() throws SecurityException {
+ this.handler.close();
+ }
+
+ /**
+ * A simple {@link Formatter} that only outputs the actual message.
+ */
+ private static class AuditLoggerFormatter extends Formatter {
+
+ /** {@inheritDoc} */
+ @Override
+ public String format(final LogRecord record) {
+ return record.getMessage() + System.lineSeparator();
+ }
+
+ }
+}
diff --git a/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/DelegatingAuditEventRepository.java b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/DelegatingAuditEventRepository.java
new file mode 100644
index 00000000..970ec816
--- /dev/null
+++ b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/DelegatingAuditEventRepository.java
@@ -0,0 +1,83 @@
+/*
+ * Copyright 2023-2024 Sweden Connect
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package se.swedenconnect.spring.saml.idp.audit.repository;
+
+import java.time.Instant;
+import java.util.Collections;
+import java.util.List;
+import java.util.Objects;
+
+import org.springframework.boot.actuate.audit.AuditEvent;
+import org.springframework.boot.actuate.audit.AuditEventRepository;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * A delegating {@link AuditEventRepository} that can be used to support multiple {@link AuditEventRepository}
+ * instances.
+ *
+ * Note that when invoking {@link #find(String, Instant, String)}, the first installed repository will be tried, and if
+ * that repository returns an empty list, the next repository will be tried.
+ *
+ *
+ * @author Martin Lindström
+ */
+@Slf4j
+public class DelegatingAuditEventRepository implements AuditEventRepository {
+
+ /** The underlying {@link AuditEventRepository} instances. */
+ private final List repositories;
+
+ /**
+ * Constructor.
+ *
+ * @param repositories the underlying {@link AuditEventRepository} instances.
+ */
+ public DelegatingAuditEventRepository(final List repositories) {
+ this.repositories = Objects.requireNonNull(repositories, "repositories must not be null");
+ }
+
+ /**
+ * Adds the event to all installed repositories.
+ */
+ @Override
+ public void add(final AuditEvent event) {
+ this.repositories.forEach(r -> {
+ try {
+ r.add(event);
+ }
+ catch (final Exception e) {
+ log.error("Failed to add event to {}", r.getClass().getSimpleName(), e);
+ }
+ });
+ }
+
+ /**
+ * The first installed repository will be tried, and if that repository returns an empty list, the next repository
+ * will be tried, and so on.
+ */
+ @Override
+ public List find(final String principal, final Instant after, final String type) {
+ for (final AuditEventRepository r : this.repositories) {
+ final List events = r.find(principal, after, type);
+ if (events != null && !events.isEmpty()) {
+ return events;
+ }
+ }
+ return Collections.emptyList();
+ }
+
+}
diff --git a/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/FileBasedAuditEventRepository.java b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/FileBasedAuditEventRepository.java
new file mode 100644
index 00000000..95b8c1f8
--- /dev/null
+++ b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/FileBasedAuditEventRepository.java
@@ -0,0 +1,103 @@
+/*
+ * Copyright 2023-2024 Sweden Connect
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package se.swedenconnect.spring.saml.idp.audit.repository;
+
+import java.io.IOException;
+import java.nio.file.Path;
+import java.time.Instant;
+import java.util.Collections;
+import java.util.List;
+import java.util.Objects;
+import java.util.function.Predicate;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+import org.springframework.boot.actuate.audit.AuditEvent;
+import org.springframework.boot.actuate.audit.AuditEventRepository;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * A write-only {@link AuditEventRepository} that writes audit events to a file.
+ *
+ * @author Martin Lindström
+ */
+@Slf4j
+public class FileBasedAuditEventRepository extends FilteringAuditEventRepository {
+
+ /** The audit logger (Java Util Logging logger). */
+ private final java.util.logging.Logger auditLogger;
+
+ /** The underlying JUL handler. */
+ private final DateRollingFileHandler handler;
+
+ /** For mapping events to strings. */
+ private final AuditEventMapper eventMapper;
+
+ /**
+ * Constructor mapping to {@link #FileBasedAuditEventRepository(String, AuditEventMapper, Predicate)} where the filter
+ * allows all events.
+ *
+ * @param logFile the log file including its path
+ * @param eventMapper the event mapper used to map events to strings
+ * @throws IOException if the logfile is invalid
+ */
+ public FileBasedAuditEventRepository(final String logFile, final AuditEventMapper eventMapper) throws IOException {
+ this(logFile, eventMapper, null);
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param logFile the log file including its path
+ * @param eventMapper the event mapper used to map events to strings
+ * @param filter filter for determining which events to log
+ * @throws IOException if the logfile is invalid
+ */
+ public FileBasedAuditEventRepository(
+ final String logFile, final AuditEventMapper eventMapper, final Predicate filter)
+ throws IOException {
+ super(filter);
+ this.eventMapper = Objects.requireNonNull(eventMapper, "eventMapper must not be null");
+
+ this.handler = new DateRollingFileHandler(logFile);
+ // Build the logger name based on the log file name ...
+ final String loggerName = Path.of(logFile).toAbsolutePath().toString();
+
+ this.auditLogger = Logger.getLogger(loggerName);
+ this.auditLogger.setLevel(Level.INFO);
+ this.auditLogger.addHandler(this.handler);
+ this.auditLogger.setUseParentHandlers(false);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public void addEvent(final AuditEvent event) {
+ try {
+ this.auditLogger.log(Level.INFO, this.eventMapper.write(event));
+ }
+ catch (final Throwable e) {
+ log.error("Failed to audit log to file - {}", e.getMessage(), e);
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public List find(final String principal, final Instant after, final String type) {
+ return Collections.emptyList();
+ }
+
+}
diff --git a/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/FilteringAuditEventRepository.java b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/FilteringAuditEventRepository.java
new file mode 100644
index 00000000..67978ff8
--- /dev/null
+++ b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/FilteringAuditEventRepository.java
@@ -0,0 +1,125 @@
+/*
+ * Copyright 2023-2024 Sweden Connect
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package se.swedenconnect.spring.saml.idp.audit.repository;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.Optional;
+import java.util.function.Predicate;
+
+import org.springframework.boot.actuate.audit.AuditEvent;
+import org.springframework.boot.actuate.audit.AuditEventRepository;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Abstract {@link AuditEventRepository} that supports filtering of events.
+ *
+ * @author Martin Lindström
+ */
+@Slf4j
+public abstract class FilteringAuditEventRepository implements AuditEventRepository {
+
+ /** The filter. */
+ private final Predicate filter;
+
+ /**
+ * Constructor setting up a filter that accepts all events.
+ */
+ public FilteringAuditEventRepository() {
+ this(null);
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param filter the filter
+ */
+ public FilteringAuditEventRepository(final Predicate filter) {
+ this.filter = Optional.ofNullable(filter).orElseGet(() -> inclusionPredicate(Collections.emptyList()));
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public final void add(final AuditEvent event) {
+ if (event != null) {
+ if (this.filter.test(event)) {
+ log.debug("Audit logging event '{}' for principal '{}' ...", event.getType(), event.getPrincipal());
+ this.addEvent(event);
+ }
+ else {
+ log.debug("Audit event {} not logged - filter rules excludes it", event.getType());
+ }
+ }
+ }
+
+ /**
+ * Logs an event.
+ *
+ * @param event the audit event to log
+ */
+ protected abstract void addEvent(final AuditEvent event);
+
+ /**
+ * Returns an audit event filter that accepts a list of event types that are accepted.
+ *
+ * If the {@code types} parameter is {@code null} or an empty list, all events are accepted.
+ *
+ *
+ * @param types the types that are accepted
+ * @return a {@link Predicate} that returns {@code true} if an event should be audited
+ */
+ public static Predicate inclusionPredicate(final List types) {
+ return event -> {
+ if (types == null || types.isEmpty()) {
+ return true;
+ }
+ return types.contains(event.getType());
+ };
+ }
+
+ /**
+ * Returns an audit event filter that excludes the given event types from being audited.
+ *
+ * If the {@code types} parameter is {@code null} or an empty list, no events are excluded.
+ *
+ *
+ * @param types the types to exclude
+ * @return a {@link Predicate} that returns {@code true} if an event should be audited
+ */
+ public static Predicate exclusionPredicate(final List types) {
+ return event -> {
+ if (types == null) {
+ return true;
+ }
+ return !types.contains(event.getType());
+ };
+ }
+
+ /**
+ * Returns an audit event filter that combines {@link #inclusionExclusionPredicate(List, List)} and
+ * {@link #exclusionPredicate(List)}.
+ *
+ * @param includeTypes the types to include (if {@code null} or empty, all events are accepted)
+ * @param dontIncludeTypes the types to exclude (if {@code null} or empty, no events are excluded)
+ * @return a {@link Predicate} that returns {@code true} if an event should be audited
+ */
+ public static Predicate inclusionExclusionPredicate(
+ final List includeTypes, final List dontIncludeTypes) {
+ return inclusionPredicate(includeTypes).and(exclusionPredicate(dontIncludeTypes));
+ }
+
+}
diff --git a/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/JsonAuditEventMapper.java b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/JsonAuditEventMapper.java
new file mode 100644
index 00000000..3c5e7ea6
--- /dev/null
+++ b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/JsonAuditEventMapper.java
@@ -0,0 +1,98 @@
+/*
+ * Copyright 2023-2024 Sweden Connect
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package se.swedenconnect.spring.saml.idp.audit.repository;
+
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+
+import org.springframework.boot.actuate.audit.AuditEvent;
+
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import se.swedenconnect.spring.saml.idp.Saml2IdentityProviderVersion;
+
+/**
+ * A JSON {@link AuditEventMapper}.
+ *
+ * @author Martin Lindström
+ * @author Felix Hellman
+ */
+public class JsonAuditEventMapper implements AuditEventMapper {
+
+ /** The underlying {@link ObjectMapper}. */
+ private final ObjectMapper mapper;
+
+ /**
+ * Constructor.
+ *
+ * @param mapper the {@link ObjectMapper}
+ */
+ public JsonAuditEventMapper(final ObjectMapper mapper) {
+ this.mapper = Objects.requireNonNull(mapper, "mapper must not be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public String write(final AuditEvent event) {
+ try {
+ return this.mapper.writerFor(AuditEvent.class).writeValueAsString(event);
+ }
+ catch (final IOException e) {
+ throw new UncheckedIOException(e);
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public AuditEvent read(final String event) {
+ try {
+ final JsonAuditEvent auditEvent = this.mapper.readerFor(JsonAuditEvent.class).readValue(event);
+ return auditEvent;
+ }
+ catch (final IOException e) {
+ throw new UncheckedIOException(e);
+ }
+ }
+
+ /**
+ * Helper class for reading events.
+ */
+ private static class JsonAuditEvent extends AuditEvent {
+
+ private static final long serialVersionUID = Saml2IdentityProviderVersion.SERIAL_VERSION_UID;
+
+ /**
+ * Adds a JsonCreator for Jackson to be able to serialize AuditEvents.
+ *
+ * @param principal to deserialize
+ * @param type to deserialize
+ * @param data to deserialize
+ */
+ @JsonCreator
+ public JsonAuditEvent(
+ @JsonProperty("principal") final String principal,
+ @JsonProperty("type") final String type,
+ @JsonProperty("data") final Map data) {
+ super(principal, type, Optional.ofNullable(data).orElse(Map.of()));
+ }
+ }
+
+}
diff --git a/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/MemoryBasedAuditEventRepository.java b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/MemoryBasedAuditEventRepository.java
new file mode 100644
index 00000000..0786e56f
--- /dev/null
+++ b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/MemoryBasedAuditEventRepository.java
@@ -0,0 +1,82 @@
+/*
+ * Copyright 2023-2024 Sweden Connect
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package se.swedenconnect.spring.saml.idp.audit.repository;
+
+import java.time.Instant;
+import java.util.List;
+import java.util.function.Predicate;
+
+import org.springframework.boot.actuate.audit.AuditEvent;
+import org.springframework.boot.actuate.audit.AuditEventRepository;
+import org.springframework.boot.actuate.audit.InMemoryAuditEventRepository;
+import org.springframework.util.Assert;
+
+/**
+ * An in-memory {@link AuditEventRepository} that adds filtering support (compared to
+ * {@link InMemoryAuditEventRepository}).
+ *
+ * @author Martin Lindström
+ */
+public class MemoryBasedAuditEventRepository extends FilteringAuditEventRepository {
+
+ public static final int DEFAULT_CAPACITY = 1000;
+
+ private final InMemoryAuditEventRepository repository;
+
+ /**
+ * Constructor setting up a memory based {@link AuditEventRepository} that logs all events and has a capacity of
+ * {@value #DEFAULT_CAPACITY}.
+ */
+ public MemoryBasedAuditEventRepository() {
+ this(null, DEFAULT_CAPACITY);
+ }
+
+ /**
+ * Constructor setting up a memory based {@link AuditEventRepository} that logs events determined by the supplied
+ * filter and has a capacity of {@value #DEFAULT_CAPACITY}.
+ *
+ * @param filter for determining which events to log
+ */
+ public MemoryBasedAuditEventRepository(final Predicate filter) {
+ this(filter, DEFAULT_CAPACITY);
+ }
+
+ /**
+ * Constructor setting up a memory based {@link AuditEventRepository} that logs events determined by the supplied
+ * filter and has a capacity given by {@code capacity}.
+ *
+ * @param filter for determining which events to log
+ * @param capacity the capacity for the number of events that should be saved
+ */
+ public MemoryBasedAuditEventRepository(final Predicate filter, final int capacity) {
+ super(filter);
+ Assert.isTrue(capacity > 0, "Invalid capacity - must be greater than 0");
+ this.repository = new InMemoryAuditEventRepository(capacity);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void addEvent(final AuditEvent event) {
+ this.repository.add(event);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public List find(final String principal, final Instant after, final String type) {
+ return this.repository.find(principal, after, type);
+ }
+
+}
diff --git a/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/RedisListAuditEventRepository.java b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/RedisListAuditEventRepository.java
new file mode 100644
index 00000000..78433894
--- /dev/null
+++ b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/RedisListAuditEventRepository.java
@@ -0,0 +1,104 @@
+/*
+ * Copyright 2023-2024 Sweden Connect
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package se.swedenconnect.spring.saml.idp.audit.repository;
+
+import java.time.Instant;
+import java.util.Collections;
+import java.util.List;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.function.Predicate;
+
+import org.springframework.boot.actuate.audit.AuditEvent;
+import org.springframework.boot.actuate.audit.AuditEventRepository;
+import org.springframework.data.redis.core.ListOperations;
+import org.springframework.data.redis.core.StringRedisTemplate;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * An implementation of the {@link AuditEventRepository} that uses Redis lists to store the events.
+ *
+ * @author Martin Lindström
+ * @author Felix Hellman
+ */
+@Slf4j
+public class RedisListAuditEventRepository extends FilteringAuditEventRepository {
+
+ /** The Redis list operations. */
+ private final ListOperations listOps;
+
+ /** The name of the Redis key holding the audit event list. */
+ private final String keyName;
+
+ /** The audit event mapper. */
+ private final AuditEventMapper eventMapper;
+
+ /**
+ * Constructor setting up the repository to log all events.
+ *
+ * @param redisTemplate the Redis template
+ * @param keyName the name of the Redis key holding the audit event list
+ * @param mapper mapper for creating/reading JSON events
+ */
+ public RedisListAuditEventRepository(final StringRedisTemplate redisTemplate, final String keyName,
+ final AuditEventMapper mapper) {
+ this(redisTemplate, keyName, mapper, null);
+ }
+
+ /**
+ * Constructor setting up the repository to log events according to the supplied filter.
+ *
+ * @param redisTemplate the Redis template
+ * @param keyName the name of the Redis key holding the audit event list
+ * @param mapper mapper for creating/reading JSON events
+ * @param filter filter for determining which events to log
+ */
+ public RedisListAuditEventRepository(final StringRedisTemplate redisTemplate, final String keyName,
+ final AuditEventMapper mapper, final Predicate filter) {
+ super(filter);
+ this.listOps = Objects.requireNonNull(redisTemplate, "redisTemplate must not be null").opsForList();
+ this.keyName = Objects.requireNonNull(keyName, "keyName must not be null");
+ this.eventMapper = Objects.requireNonNull(mapper, "mapper must not be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void addEvent(final AuditEvent event) {
+ try {
+ this.listOps.rightPush(this.keyName, this.eventMapper.write(event));
+ }
+ catch (final Throwable e) {
+ log.error("Failed to write event '{}' to Redis list {}", event.getType(), this.keyName, e);
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public List find(final String principal, final Instant after, final String type) {
+ final long size = Optional.ofNullable(this.listOps.size(this.keyName)).orElse(0L);
+ final List list = this.listOps.range(this.keyName, 0, size);
+ if (list == null) {
+ return Collections.emptyList();
+ }
+ return list.stream()
+ .map(e -> this.eventMapper.read(e))
+ .filter(e -> type != null ? type.equals(e.getType()) : true)
+ .filter(e -> principal != null ? principal.equals(e.getPrincipal()) : true)
+ .filter(e -> after != null ? after.isBefore(e.getTimestamp()) : true)
+ .toList();
+ }
+}
diff --git a/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/RedissonTimeSeriesAuditEventRepository.java b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/RedissonTimeSeriesAuditEventRepository.java
new file mode 100644
index 00000000..8d9268c2
--- /dev/null
+++ b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/RedissonTimeSeriesAuditEventRepository.java
@@ -0,0 +1,108 @@
+/*
+ * Copyright 2023-2024 Sweden Connect
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package se.swedenconnect.spring.saml.idp.audit.repository;
+
+import java.time.Instant;
+import java.time.temporal.ChronoUnit;
+import java.util.Collection;
+import java.util.List;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.function.Predicate;
+
+import org.redisson.api.RedissonClient;
+import org.redisson.api.TimeSeriesEntry;
+import org.springframework.boot.actuate.audit.AuditEvent;
+import org.springframework.boot.actuate.audit.AuditEventRepository;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * An {@link AuditEventRepository} implementation that uses Redis time series to store events.
+ *
+ * @author Martin Lindström
+ * @author Felix Hellman
+ */
+@Slf4j
+public class RedissonTimeSeriesAuditEventRepository extends FilteringAuditEventRepository {
+
+ /** The Redis client. */
+ private final RedissonClient client;
+
+ /** The Redis timeseries name holding the audit events. */
+ private final String tsName;
+
+ /** The audit event mapper. */
+ private final AuditEventMapper eventMapper;
+
+ /**
+ * Constructor setting up the repository to log all events.
+ *
+ * @param client the Redis client
+ * @param tsName the Redis timeseries name holding the audit events
+ * @param mapper mapper for creating/reading JSON events
+ */
+ public RedissonTimeSeriesAuditEventRepository(final RedissonClient client, final String tsName,
+ final AuditEventMapper mapper) {
+ this(client, tsName, mapper, null);
+ }
+
+ /**
+ * Constructor setting up the repository to log events according to the supplied filter.
+ *
+ * @param client the Redis client
+ * @param tsName the Redis timeseries name holding the audit events
+ * @param mapper mapper for creating/reading JSON events
+ * @param filter filter for determining which events to log
+ */
+ public RedissonTimeSeriesAuditEventRepository(final RedissonClient client, final String tsName,
+ final AuditEventMapper mapper, final Predicate filter) {
+ super(filter);
+ this.client = Objects.requireNonNull(client, "client must not be null");
+ this.tsName = Objects.requireNonNull(tsName, "tsName must not be null");
+ this.eventMapper = Objects.requireNonNull(mapper, "mapper must not be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void addEvent(final AuditEvent event) {
+ try {
+ this.client.getTimeSeries(this.tsName)
+ .add(event.getTimestamp().toEpochMilli(), this.eventMapper.write(event));
+ }
+ catch (final Throwable e) {
+ log.error("Failed to write event '{}' to Redis timeseries {}", event.getType(), this.tsName, e);
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public List find(final String principal, final Instant after, final String type) {
+ final Collection> timeSeries =
+ this.client.getTimeSeries(this.tsName).entryRange(
+ Optional.ofNullable(after)
+ .orElseGet(() -> Instant.EPOCH)
+ .toEpochMilli(),
+ Instant.now().plus(1, ChronoUnit.MINUTES).toEpochMilli());
+
+ return timeSeries.stream()
+ .map(e -> this.eventMapper.read((String) e.getValue()))
+ .filter(e -> type != null ? type.equals(e.getType()) : true)
+ .filter(e -> principal != null ? principal.equals(e.getPrincipal()) : true)
+ .toList();
+ }
+
+}
diff --git a/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/package-info.java b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/package-info.java
new file mode 100644
index 00000000..7cec9397
--- /dev/null
+++ b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/audit/repository/package-info.java
@@ -0,0 +1,4 @@
+/**
+ * Audit logging repositories.
+ */
+package se.swedenconnect.spring.saml.idp.audit.repository;
\ No newline at end of file
diff --git a/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/authnrequest/validation/replay/InMemoryReplayCache.java b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/authnrequest/validation/replay/InMemoryReplayCache.java
new file mode 100644
index 00000000..c606b69b
--- /dev/null
+++ b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/authnrequest/validation/replay/InMemoryReplayCache.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright 2024 Sweden Connect
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package se.swedenconnect.spring.saml.idp.authnrequest.validation.replay;
+
+import java.time.Instant;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentMap;
+
+import org.opensaml.storage.ReplayCache;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * An in-memory implementation of the {@link ReplayCache} interface.
+ *
+ * @author Martin Lindström
+ */
+@Slf4j
+public class InMemoryReplayCache implements ReplayCache {
+
+ /** The cache. */
+ private final ConcurrentMap cache = new ConcurrentHashMap<>();
+
+ /**
+ * Constructor.
+ */
+ public InMemoryReplayCache() {
+ log.warn("{} is used, consider using a distributed cache for production", this.getClass().getSimpleName());
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean check(final String context, final String key, final Instant expires) {
+
+ // Remove expired entries ...
+ //
+ final long now = Instant.now().getEpochSecond();
+ this.cache.entrySet().removeIf(e -> e.getValue() < now);
+
+ if (this.cache.containsKey(key)) {
+ log.debug("Key '{}' was present in in-memory replay cache, returning false", key);
+ return false;
+ }
+ else {
+ this.cache.put(key, expires.getEpochSecond());
+ log.trace("Key '{}' was not present in in-memory replay cache, adding it and returning true", key);
+ return true;
+ }
+ }
+
+}
diff --git a/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/authnrequest/validation/replay/RedisReplayCache.java b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/authnrequest/validation/replay/RedisReplayCache.java
new file mode 100644
index 00000000..b34926cf
--- /dev/null
+++ b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/authnrequest/validation/replay/RedisReplayCache.java
@@ -0,0 +1,70 @@
+/*
+ * Copyright 2023-2024 Sweden Connect
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package se.swedenconnect.spring.saml.idp.authnrequest.validation.replay;
+
+import java.time.Instant;
+import java.util.Objects;
+
+import org.opensaml.storage.ReplayCache;
+import org.springframework.data.redis.core.StringRedisTemplate;
+import org.springframework.data.redis.core.ZSetOperations;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * A generic Redis {@link ReplayCache} implementation.
+ *
+ * @author Martin Lindström
+ */
+@Slf4j
+public class RedisReplayCache implements ReplayCache {
+
+ /** The Redis set. */
+ private final ZSetOperations redisSet;
+
+ /**
+ * Constructor.
+ *
+ * @param redisTemplate the Redis template
+ */
+ public RedisReplayCache(final StringRedisTemplate redisTemplate) {
+ this.redisSet = Objects.requireNonNull(redisTemplate, "redisTemplate must not be null").opsForZSet();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean check(final String context, final String key, final Instant expires) {
+
+ // Remove expired entries ...
+ //
+ final Long noRemoved = this.redisSet.removeRangeByScore(context, 0, Instant.now().getEpochSecond());
+ log.trace("Removed {} expired entries in Redis replay cache", noRemoved);
+
+ // If the key is present, we return false, otherwise we add the key to the set and return true.
+ //
+ if (this.redisSet.rank(context, key) != null) {
+ log.debug("Key '{}' was present in Redis replay cache ({}), returning false", key, context);
+ return false;
+ }
+ else {
+ this.redisSet.add(context, key, expires.getEpochSecond());
+ log.trace("Key '{}' was not present in Redis replay cache ({}), adding it and returning true", key, context);
+ return true;
+ }
+
+ }
+
+}
diff --git a/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/authnrequest/validation/replay/package-info.java b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/authnrequest/validation/replay/package-info.java
new file mode 100644
index 00000000..d9fec773
--- /dev/null
+++ b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/authnrequest/validation/replay/package-info.java
@@ -0,0 +1,4 @@
+/**
+ * Classes for replay checking.
+ */
+package se.swedenconnect.spring.saml.idp.authnrequest.validation.replay;
\ No newline at end of file
diff --git a/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/config/Saml2IdpConfiguration.java b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/config/Saml2IdpConfiguration.java
index 0690f07e..8807b32e 100644
--- a/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/config/Saml2IdpConfiguration.java
+++ b/saml-identity-provider/src/main/java/se/swedenconnect/spring/saml/idp/config/Saml2IdpConfiguration.java
@@ -23,6 +23,7 @@
import org.springframework.context.annotation.Configuration;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
+import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.util.matcher.RequestMatcher;
@@ -111,7 +112,7 @@ public static void applyDefaultSecurity(final HttpSecurity http,
.authorizeHttpRequests(authorizeRequests -> authorizeRequests.anyRequest().authenticated())
.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
.securityContext((sc) -> sc.requireExplicitSave(false))
- .apply(idpConfigurer);
+ .with(idpConfigurer, Customizer.withDefaults());
}
/**
diff --git a/samples/client/pom.xml b/samples/client/pom.xml
index 3a350c7f..0395dc7c 100644
--- a/samples/client/pom.xml
+++ b/samples/client/pom.xml
@@ -9,7 +9,7 @@
se.swedenconnect.spring.saml.idp
spring-saml-idp-samples-parent
- 2.0.2
+ 2.1.0-SNAPSHOT
Sweden Connect :: Spring SAML Identity Provider :: Samples :: Client Application
@@ -74,6 +74,12 @@
1.2.8