Describe the bug
The fix for #18243 is missing in the 7.1.x, 7.0.x and main branches.
To Reproduce
Configure a project with Spring Security 7.1.1
Configure SAML with an override for the Saml2AuthenticationRequestRepository:
@Bean
public Saml2AuthenticationRequestRepository<?> samlRequestRepository()
{
return new CacheSaml2AuthenticationRequestRepository();
}
Any attempt to log in will result in an IllegalArgumentException being thrown:
java.lang.IllegalArgumentException: relayState must not be null
at org.springframework.util.Assert.notNull(Assert.java:182)
at org.springframework.security.saml2.provider.service.web.CacheSaml2AuthenticationRequestRepository.saveAuthenticationRequest(CacheSaml2AuthenticationRequestRepository.java:58)
at org.springframework.security.saml2.provider.service.web.Saml2WebSsoAuthenticationRequestFilter.sendPost(Saml2WebSsoAuthenticationRequestFilter.java:137)
at org.springframework.security.saml2.provider.service.web.Saml2WebSsoAuthenticationRequestFilter.doFilterInternal(Saml2WebSsoAuthenticationRequestFilter.java:110)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:385)
Expected behavior
Browser is redirected to IdP
Sample
I could reproduce using https://github.com/spring-projects/spring-security-samples/tree/main/servlet/spring-boot/java/saml2/login by adding the bean definition to Saml2LoginApplication. I did remove the Docker support and used my own entity-id and metadata-uri though.
Analysis
It appears that the fix in commit e250236 was overwritten in commit 3f05f4d.
Describe the bug
The fix for #18243 is missing in the 7.1.x, 7.0.x and main branches.
To Reproduce
Configure a project with Spring Security 7.1.1
Configure SAML with an override for the
Saml2AuthenticationRequestRepository:Any attempt to log in will result in an IllegalArgumentException being thrown:
Expected behavior
Browser is redirected to IdP
Sample
I could reproduce using https://github.com/spring-projects/spring-security-samples/tree/main/servlet/spring-boot/java/saml2/login by adding the bean definition to Saml2LoginApplication. I did remove the Docker support and used my own entity-id and metadata-uri though.
Analysis
It appears that the fix in commit e250236 was overwritten in commit 3f05f4d.