OpenSaml4AuthenticationRequestResolver method resolve

[tundoMatteo]

In spring-security-saml2-service-provider 5.7.2. the class OpenSaml4AuthenticationRequestResolver has this method:

@Override public <T extends AbstractSaml2AuthenticationRequest> T resolve(HttpServletRequest request) { return this.authnRequestResolver.resolve(request, (registration, authnRequest) -> { authnRequest.setIssueInstant(Instant.now(this.clock)); this.contextConsumer.accept(new AuthnRequestContext(request, registration, authnRequest)); }); }

the method authnRequest.setIssueInstant(); requires a DateTime not an Instant.

The result is a

java.lang.NoSuchMethodError: org.opensaml.saml.saml2.core.AuthnRequest.setIssueInstant(Ljava/time/Instant;) at org.springframework.security.saml2.provider.service.web.authentication.OpenSaml4AuthenticationRequestResolver.lambda$resolve$1OpenSaml4AuthenticationRequestResolver.java:58)

Could you please check the issue?

[marcusdacoregio]

Hi @tundoMatteo, this is a duplicate of #10547.

I'll close this but feel free to reach out if you need any further help.

[tundoMatteo]

@marcusdacoregio so the solution is to update OpenSaml to version 4.1.0? But spring brings with it the version 3.4.6 and the problem is not concerned with the logout, since i was trying to change the nameIdPolicy of the Saml Request.

The 4.1.0 does not exist on maven repository and you sare using the version 3.4.6 in spring-security-saml2-service-provider pom.

[marcusdacoregio]

Yes, Spring Security SAML Service Provider has the OpenSAML version 3.4.6 in it because we support OpenSaml3 (which will be removed in Spring Security 6, see #10556).

Since you are using OpenSaml4AuthenticationRequestResolver you have to use OpenSAML4, see here how to configure it using Gradle. The OpenSAML team does not publish their newest versions in Maven Central, so you have to add their own repository to your build file.

[tundoMatteo]

@marcusdacoregio ok thank you but it would be useful to update the guide here where there is this snippet of code:

@Bean Saml2AuthenticationRequestResolver authenticationRequestResolver(RelyingPartyRegistrationRepository registrations) { RelyingPartyRegistrationResolver registrationResolver = new DefaultRelyingPartyRegistrationResolver(registrations); OpenSaml4AuthenticationRequestResolver authenticationRequestResolver = new OpenSaml4AuthenticationRequestResolver(registrationResolver); authenticationRequestResolver.setAuthnRequestCustomizer((context) -> context .getAuthnRequest().setForceAuthn(true)); return authenticationRequestResolver; }

Here it shows to use the OpenSaml4AuthenticationRequestResolver, but it will not work if i don't force the import of open saml 4 in the pom.