Implementing Stateless Sessions with Spring Security and SAML2 Service Provider in Java Application

My Java application uses spring security and Saml2 as a service provider. I am able to integrate with the identity provider and get saml assertions correctly. I want to avoid using JSESSIONID for overhead in my application since I have custom session attribute x-auth as cookie.

But, I see that a session is created every time and remains persistent till the user sign's out.

I tried adding the below line to the configure method, http.sessionManagement() .sessionCreationPolicy(SessionCreationPolicy.STATELESS);

But, with this setting I am always being asked to login to Identity Provider.

If I login, it comes back to the page asking me to login again in a loop.

I am not sure if this is the correct behaviour when disabling sessions.

Can anyone provide me with the right approach to use stateless sessions with below code ?

 @Bean
  SecurityFilterChain configure(HttpSecurity http) throws Exception {
    OpenSaml4AuthenticationProvider authenticationProvider = new OpenSaml4AuthenticationProvider();
    authenticationProvider.setResponseAuthenticationConverter(createTokenCredential());

    Saml2MetadataFilter filter = new Saml2MetadataFilter(relyingPartyRegistrationRepository,
        new OpenSamlMetadataResolver());
    http.addFilterBefore(filter, Saml2WebSsoAuthenticationFilter.class);
    loginSuccessHandler.setTargetUrlParameter(Saml2ParameterNames.RELAY_STATE);

    http.authorizeHttpRequests(requests -> requests
            .requestMatchers("/saml2/service-provider-metadata/**")
            .permitAll()
        ).addFilterAfter(authTokenSessionRestore, SecurityContextHolderFilter.class)
        .saml2Login((saml2) -> saml2
            .loginProcessingUrl("/saml/SSO")
            .authenticationManager(new ProviderManager(authenticationProvider))
            .relyingPartyRegistrationRepository(relyingPartyRegistrationRepository)
            .successHandler(loginSuccessHandler)
            .failureHandler(loginFailureHandler)

        ).saml2Logout(withDefaults())
        .logout().logoutSuccessUrl("/login")
        .logoutSuccessHandler(logoutSuccessHandler);



    http.sessionManagement(session -> {
          session.sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }); // dont create a session for this configuration
}

Start at the SecurityFilterChain configure entry point and trace the interaction between SessionCreationPolicy.STATELESS, the SAML login processing URL, and authTokenSessionRestore. Check how authentication is restored after the identity provider callback and whether the configured custom cookie prevents the login loop; done means SAML login completes without repeated redirects or persistent JSESSIONID use.