SpringBoot 3.X Upgrade: Saml2 Redirection to Custom URL not working - Always redirects to <hostname>/saml2/authenticate/<registrationId>

While upgrading the springboot project from 2.X to 3.X, I had to update the SecurityConfig class as we no longer have WebSecurityConfigurerAdapter

I had configured SecurityFilterChain

public class CustomAuthenticationSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {

    private final RedirectStrategy strategy = new CustomRedirectStrategy();
    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        this.setDefaultTargetUrl("https://<mydomain>/");
        this.setRedirectStrategy(strategy);
        this.setAlwaysUseDefaultTargetUrl(true);
        response.addHeader("Location", getDefaultTargetUrl());
        super.onAuthenticationSuccess(request, response, authentication);
    }

}

This is my CustomSuthenticationSuccessHandler

public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    return http.saml2Login(saml2 -> {
        try {
        saml2.relyingPartyRegistrationRepository(relyingPartyRegistrationRepository())
                        .authenticationRequestUri(baseUrl)
                        .defaultSuccessUrl(baseUrl, true)
                        .successHandler(customAuthSuccessHandler())
                        .failureHandler(new SimpleUrlAuthenticationFailureHandler());
        } catch (Exception e) {
            LOGGER.info("#########Exception in filterChain: {}", e);
        }
        }).authorizeHttpRequests((authorizeHttpRequests) -> authorizeHttpRequests.requestMatchers("/saml**")
            .permitAll().anyRequest().authenticated())
            .csrf(csrf -> csrf.ignoringRequestMatchers("/saml*"))
            .sessionManagement(sessionMgmt -> sessionMgmt.sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED))
            .build();

But after successful Authentication The url is not routing to my hostname<abc.com> which has my landing page, instead the url requested is always <abc.com/saml2/authenticate/{registrationId}>

How do I override this default routing?

I had tried to override the CustomAuthenticationSessionHandler to change the default behaviour but I see my code is not being executed.

Upvotes: 0

Views: 73

Answers (0)

Related Questions