A default password is generated by Boot in a Servlet application when SAML 2.0 Login is being used.
For the OAuth2 Login feature, it checks if a bean of type ClientRegistrationRepository exists to prevent the bean creation. It should do the same for the RelyingPartyRegistrationRepository, which is the equivalent for SAML 2.0.
To reproduce it just run any of those samples in the Spring Security samples repository and the password is printed to the console.
Related: - https://github.com/spring-projects/spring-boot/issues/14557
Comment From: snicoll
Closing in favor of PR #29263