dependency: OpenSAML 5.1.6 upgrade

[strehle]

Spring Security 6.5.x uses versions

org-opensaml4 = "4.3.2"
org-opensaml5 = "5.1.2"

Latest opensaml5 would be 5.2.1, but this version pulls directly classes from non fips package and therefore not working - right now. - need to check / fix later.

Opesaml5 5.1.x we could proceed.
Up to this version, it is running with BC FIPS libraries.

At least a version that could work together with spring security 7.x and then boot 4.x

---

If we are on newer Spring Boot we should refactor and remove many of the custom classes

[Copilot]

Pull request overview

Upgrades the server’s SAML/OpenSAML integration to OpenSAML 5.1.6 (aligned with Spring Security’s OpenSAML 5 track) and updates UAA’s SAML wiring, metadata, logout, and tests to the OpenSaml5 APIs and the Shibboleth net.shibboleth.shared package relocation.

Changes:

• Bump OpenSAML dependency version to 5.1.6 and constrain Shibboleth repo resolution to relevant groups.
• Migrate SAML authentication, bearer grant, metadata, and logout codepaths from OpenSaml4-* to OpenSaml5-* APIs.
• Update tests and test utilities for OpenSAML 5 / Shibboleth shared package changes.

Reviewed changes

Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/UaaInResponseToHandlingResponseValidatorTest.java	Updates mocks/generics to use OpenSaml5 response token types.
server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/TestCustomOpenSamlObjects.java	Switches Shibboleth XML utilities to net.shibboleth.shared and aligns comments/behavior with OpenSAML 5.
server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/SamlMetadataEndpointKeyRotationTests.java	Adjusts test initialization to ensure OpenSAML is set up for metadata generation under OpenSAML 5.
server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/Saml2TestUtils.java	Updates SerializeSupport import to Shibboleth shared package.
server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/Saml2BearerGrantAuthenticationConverterTest.java	Updates serialization import and swaps OpenSaml4 assertion tokens to OpenSaml5 equivalents.
server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUnitTests.java	Renames/retargets unit tests to OpenSaml5 provider and updates Spring Security registration builder API usage.
server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java	Renames UAA integration tests class and resource reference to OpenSaml5 naming.
server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/UaaInResponseToHandlingResponseValidator.java	Rebinds the response validator wrapper to OpenSaml5 response token types.
server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlUaaResponseAuthenticationConverter.java	Updates converter to accept OpenSaml5 response token types.
server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlMetadataEntityDescriptorCustomizer.java	Migrates metadata customizer to OpenSaml5MetadataResolver and Shibboleth shared CriteriaSet.
server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlMetadataEndpoint.java	Uses OpenSaml5MetadataResolver for SAML SP metadata rendering.
server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlConfiguration.java	Updates OpenSAML initialization to OpenSAML 5 configuration APIs (PropertiesAdapter source).
server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlAuthenticationFilterConfig.java	Swaps request/logout resolvers to OpenSaml5 and updates request matching to PathPatternRequestMatcher.
server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/Saml2Utils.java	Routes bearer decode errors through OpenSaml5 provider exception helper.
server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/Saml2BearerGrantAuthenticationConverter.java	Migrates parser pool import and switches all OpenSaml4 helpers/tokens to OpenSaml5.
server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSamlVerificationUtils.java	Updates Shibboleth CriteriaSet import and OpenSaml5 wording in docs.
server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSamlDecryptionUtils.java	Updates OpenSaml5 wording in docs (utility retained for custom provider).
server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProvider.java	Implements OpenSAML 5 compatibility changes (package moves, validation API changes, address-check handling).
server/src/main/java/org/cloudfoundry/identity/uaa/authentication/SamlLogoutResponseValidator.java	Updates delegate to OpenSaml5LogoutResponseValidator.
server/src/main/java/org/cloudfoundry/identity/uaa/authentication/SamlLogoutRequestValidator.java	Updates delegate to OpenSaml5LogoutRequestValidator.
dependencies.gradle	Bumps versions.opensaml to 5.1.6.
build.gradle	Adds Shibboleth releases repo content filtering and updates the OpenSAML version pin rationale.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.