Related to #10243
To customize how a RelyingPartyRegistration is resolved from a login request, an application needs to configure an Saml2AuthenticationTokenConverter in the DSL:
@Bean
SecurityFilterChain appSecurity(HttpSecurity http, RelyingPartyRegistrationRepository registrations) throws Exception {
RelyingPartyRegistrationResolver registrationResolver = new DefaultRelyingPartyRegistrationResolver(registrations);
Saml2AuthenticationTokenConverter authenticationConverter = new Saml2AuthenticationTokenConverter(registrationResolver);
http
.authorizeHttpRequests((authorize) -> authorize
.anyRequest().authenticated()
)
.saml2Login((saml2) -> saml2
.authenticationConverter(authenticationConverter)
);
return http.build();
}
Because a Saml2AuthenticationTokenConverter is often based on a RelyingPartyRegistrationRepository bean, this could be modestly simplified by Saml2LoginConfigurer picking up a Saml2AuthenticationTokenConverter bean:
@Bean
Saml2AuthenticationTokenConverter authenticationConverter(RelyingPartyRegistrationRepository registrations) {
RelyingPartyRegistrationResolver registrationResolver = new DefaultRelyingPartyRegistrationResolver(registrations);
return new Saml2AuthenticationTokenConverter(registrationResolver);
}