Add support for Elliptic key as relying party signing credentials' private key

Hello.
I'm using Spring Boot 2.5.3 (and Java 13 atm with OpenSaml 4.1.1) and - using autoconfiguration - I'm unable to use Elliptic curve private key as relaying party signing credentials' private key - it looks like only RSA keys are supported.
I'm integrating with our govermnent's IDP and the usage of elliptic keys is mandatory.

Here is a "trimmed" stacktrace:

(....omitted....)
Caused by: java.lang.IllegalArgumentException: java.security.spec.InvalidKeySpecException: java.security.InvalidKeyException: Invalid RSA private key
	at org.springframework.security.converter.RsaKeyConverters.lambda$pkcs8$0(RsaKeyConverters.java:88)
	at org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyRegistrationConfiguration.readPrivateKey(Saml2RelyingPartyRegistrationConfiguration.java:138)
	... 75 common frames omitted
Caused by: java.security.spec.InvalidKeySpecException: java.security.InvalidKeyException: Invalid RSA private key
	at java.base/sun.security.rsa.RSAKeyFactory.engineGeneratePrivate(RSAKeyFactory.java:251)
	at java.base/java.security.KeyFactory.generatePrivate(KeyFactory.java:390)
	at org.springframework.security.converter.RsaKeyConverters.lambda$pkcs8$0(RsaKeyConverters.java:85)
	... 76 common frames omitted
Caused by: java.security.InvalidKeyException: Invalid RSA private key
	at java.base/sun.security.rsa.RSAPrivateCrtKeyImpl.parseKeyBits(RSAPrivateCrtKeyImpl.java:285)
	at java.base/sun.security.pkcs.PKCS8Key.decode(PKCS8Key.java:342)
	at java.base/sun.security.pkcs.PKCS8Key.decode(PKCS8Key.java:355)
	at java.base/sun.security.rsa.RSAPrivateCrtKeyImpl.<init>(RSAPrivateCrtKeyImpl.java:130)
	at java.base/sun.security.rsa.RSAPrivateCrtKeyImpl.newKey(RSAPrivateCrtKeyImpl.java:80)
	at java.base/sun.security.rsa.RSAKeyFactory.generatePrivate(RSAKeyFactory.java:356)
	at java.base/sun.security.rsa.RSAKeyFactory.engineGeneratePrivate(RSAKeyFactory.java:247)
	... 78 common frames omitted
Caused by: java.io.IOException: Version must be 0
	at java.base/sun.security.rsa.RSAPrivateCrtKeyImpl.parseKeyBits(RSAPrivateCrtKeyImpl.java:263)
	... 84 common frames omitted

My application.yml has only one relying party:

spring:
  thymeleaf:
    cache: false
  security:
    saml2:
      network:
        read-timeout: 8000
        connect-timeout: 4000
      relyingparty:
        registration:
          samlexample:
            signing:
              credentials:
                - private-key-location: "classpath:credentials/SIGN_EC_privatekey_pkcs8.pem"
                  certificate-location: "classpath:credentials/SIGN_EC_certificate.pem"
            identityprovider:
              entity-id: some-environment.login.gov.pl
              singlesignon:
                sign-request: true
                url: https://some-environment.login.gov.pl/login/SingleSignOnService
              metadata-uri: https://some-environment.login.gov.pl/login/metadata

My current workaround is to "shadow" the configuration class (copy & paste) and hardcode loading the EC keys myself.

Thanks in advance for looking into this.
Lukasz

Start by reading Saml2RelyingPartyRegistrationConfiguration.java, especially readPrivateKey, and RsaKeyConverters.java where the stack trace shows RSA-specific parsing. Trace how signing credentials are loaded from the application.yml configuration and verify that EC private-key support works with the SAML relying-party setup; existing relevant tests are not named in the issue.