spring-projects / spring-projects/spring-security
Fix for #18243 (CacheSaml2AuthenticationRequestRepository.saveAuthenticationRequest(..) throws IllegalArgumentException) is missing in 7.1.1
@jzheaux is already working on this.
Since Sep 14, 2026.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Describe the bug
The fix for #18243 is missing in the 7.1.x, 7.0.x and main branches.
To Reproduce
Configure a project with Spring Security 7.1.1
Configure SAML with an override for the Saml2AuthenticationRequestRepository:
@Bean
public Saml2AuthenticationRequestRepository<?> samlRequestRepository()
{
return new CacheSaml2AuthenticationRequestRepository();
}
Any attempt to log in will result in an IllegalArgumentException being thrown:
java.lang.IllegalArgumentException: relayState must not be null
at org.springframework.util.Assert.notNull(Assert.java:182)
at org.springframework.security.saml2.provider.service.web.CacheSaml2AuthenticationRequestRepository.saveAuthenticationRequest(CacheSaml2AuthenticationRequestRepository.java:58)
at org.springframework.security.saml2.provider.service.web.Saml2WebSsoAuthenticationRequestFilter.sendPost(Saml2WebSsoAuthenticationRequestFilter.java:137)
at org.springframework.security.saml2.provider.service.web.Saml2WebSsoAuthenticationRequestFilter.doFilterInternal(Saml2WebSsoAuthenticationRequestFilter.java:110)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:385)
Expected behavior
Browser is redirected to IdP
Sample
I could reproduce using https://github.com/spring-projects/spring-security-samples/tree/main/servlet/spring-boot/java/saml2/login by adding the bean definition to Saml2LoginApplication. I did remove the Docker support and used my own entity-id and metadata-uri though.
Analysis
It appears that the fix in commit e25023627941233513b062a0e1ad846e668f99c9 was overwritten in commit 3f05f4d30c35e00218eaee4490471145dbf2a451.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.