Spring Boot 3.0 - SAML Login redirect not working

Question

I'm currently upgrading from Spring Boot 2.7.7 to Spring Boot 3.0.1.

Unfortunately, the SAML-Redirect that works under Spring Boot 2.x does not work anymore.

I had to replace some deprecated code with what is recommended by Spring according to this commit: https://github.com/spring-projects/spring-security/commit/953c9294d0912d65cd90c8e729a47a0d74697392

under Spring Boot 2.x

@Bean
public Saml2AuthenticationRequestContextResolver saml2AuthenticationRequestContextResolver(
       RelyingPartyRegistrationResolver relyingPartyRegistrationResolver) {
    return new DefaultSaml2AuthenticationRequestContextResolver(relyingPartyRegistrationResolver);
}

under Spring Boot 3.x

@Bean
public Saml2AuthenticationRequestResolver saml2AuthenticationRequestResolver(
        RelyingPartyRegistrationResolver relyingPartyRegistrationResolver) {
    return new OpenSaml4AuthenticationRequestResolver(relyingPartyRegistrationResolver);
}

This was the only change I made in the class Saml2WebSecurityConfig, that is now as follows:

@EnableWebSecurity
@Configuration
public class Saml2WebSecurityConfig {

    private final ConfigProperties configProperties;

    public Saml2WebSecurityConfig(ConfigProperties configProperties) {
        this.configProperties = configProperties;
    }

    @Bean
    public RelyingPartyRegistrationRepository relyingPartyRegistrationRepository() throws Exception {
        // Generate signing with private key and public key
        Saml2X509Credential signingCredential = null; // not relevant for context
        // Single verification certificate
        Saml2X509Credential verificationCredential =  null; // not relevant for context

        RelyingPartyRegistration registration = RelyingPartyRegistration
                .withRegistrationId(configProperties.getRegistrationId())
                .entityId(configProperties.getEntity())
                .signingX509Credentials(c -> c.add(signingCredential))
                .singleLogoutServiceLocation(configProperties.getSingleLogoutServiceLocation())
                .assertingPartyDetails(party -> party.entityId(configProperties.getAssertionId())
                        .singleSignOnServiceLocation(configProperties.getSingleSignOnServiceLocation())
                        .singleSignOnServiceBinding(Saml2MessageBinding.POST)
                        .wantAuthnRequestsSigned(true)
                        .signingAlgorithms((sign) -> sign.add(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256))
                        .verificationX509Credentials(c -> c.add(verificationCredential))
                )
                .build();
        return new InMemoryRelyingPartyRegistrationRepository(registration);
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(authorize -> authorize
                        .anyRequest().authenticated())
                .saml2Login(saml2 -> {
                    try {
                        saml2.relyingPartyRegistrationRepository(this.relyingPartyRegistrationRepository());
                    } catch (Exception e) {
                        throw new RuntimeException(e);
                    }
                }).saml2Logout(withDefaults());
        http.csrf().disable();
        return http.build();
    }

    @Bean
    public Saml2AuthenticationRequestResolver saml2AuthenticationRequestResolver(
            RelyingPartyRegistrationResolver relyingPartyRegistrationResolver) {
        return new OpenSaml4AuthenticationRequestResolver(relyingPartyRegistrationResolver);
    }

    @Bean
    public RelyingPartyRegistrationResolver relyingPartyRegistrationResolver(
            RelyingPartyRegistrationRepository relyingPartyRegistrationRepository) {
        return new DefaultRelyingPartyRegistrationResolver(relyingPartyRegistrationRepository);
    }
}

This are the dependencies / repositories (effective-pom):

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
            <version>3.0.1</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-core</artifactId>
            <version>6.0.3</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context</artifactId>
            <version>6.0.3</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-webmvc</artifactId>
            <version>6.0.3</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
            <version>3.0.1</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-beans</artifactId>
            <version>6.0.3</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
            <version>6.0.1</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-saml2-service-provider</artifactId>
            <version>6.0.1</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-web</artifactId>
            <version>6.0.3</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
            <version>2.0.6</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
            <version>6.0.1</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-core</artifactId>
            <version>6.0.1</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot</artifactId>
            <version>3.0.1</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.opensaml</groupId>
            <artifactId>opensaml-xmlsec-api</artifactId>
            <version>4.3.0</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.springdoc</groupId>
            <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
            <version>2.0.2</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.apache.tomcat.embed</groupId>
            <artifactId>tomcat-embed-core</artifactId>
            <version>10.1.4</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.openapitools</groupId>
            <artifactId>jackson-databind-nullable</artifactId>
            <version>0.2.4</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-annotations</artifactId>
            <version>2.14.1</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>io.swagger.core.v3</groupId>
            <artifactId>swagger-annotations-jakarta</artifactId>
            <version>2.2.8</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>jakarta.validation</groupId>
            <artifactId>jakarta.validation-api</artifactId>
            <version>3.0.2</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.opensaml</groupId>
            <artifactId>opensaml-saml-api</artifactId>
            <version>4.3.0</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.opensaml</groupId>
            <artifactId>opensaml-core</artifactId>
            <version>4.3.0</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.opensaml</groupId>
            <artifactId>opensaml-saml-impl</artifactId>
            <version>4.3.0</version>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>net.shibboleth.utilities</groupId>
            <artifactId>java-support</artifactId>
            <version>8.4.0</version>
            <scope>compile</scope>
        </dependency>
    </dependencies>
    <repositories>
        <repository>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
            <id>central</id>
            <url>https://repo1.maven.org/maven2</url>
        </repository>
        <repository>
            <id>Shibboleth</id>
            <name>Shibboleth</name>
            <url>https://build.shibboleth.net/nexus/content/repositories/releases/</url>
        </repository>
    </repositories>

Edit: How the user is extracted:

@Profile("!local")
@RequestScope
@Component
public class SamlUserContext implements UserContext {

    @Override
    public LoggedInUser user() {
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();

        if (!(authentication instanceof Saml2Authentication)) {
            String message = String.format("The type %s is not the expected Saml2Authentication", authentication.getClass());
            throw new IllegalStateException(message);
        }

        if (!(authentication.getPrincipal() instanceof Saml2AuthenticatedPrincipal saml2AuthenticatedPrincipal)) {
            String message = String.format("The type %s is not the expected Saml2AuthenticatedPrincipal",
                    authentication.getPrincipal().getClass());
            throw new IllegalStateException(message);
        }

        return new SamlUser(saml2AuthenticatedPrincipal);
    }
}