Hi Spring Security team,

I've encounter an issue using the new Saml2 support with Spring Session.

In the OpenSamlAuthenticationProvider class in the authenticate method we create the authentication this way :

new Saml2Authentication(
    () -> username, token.getSaml2Response(),
    this.authoritiesMapper.mapAuthorities(getAssertionAuthorities(assertion))
)

But this isn't serializable with the default serializer provided by Spring Session.

Solution

IMO provide an implementation of the AuthenticatedPrincipal instead of using an anonymous class should do the trick here.

What do you think about that ?

Have a nice day :)