spring-projects / spring-projects/spring-security

Fix for #18243 (CacheSaml2AuthenticationRequestRepository.saveAuthenticationRequest(..) throws IllegalArgumentException) is missing in 7.1.1

Open
#19,627 1 comment 0 reactions 1 assignee View on GitHub

@jzheaux is already working on this.

Since Sep 14, 2026.

status: waiting-for-triage type: bug
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Describe the bug
The fix for #18243 is missing in the 7.1.x, 7.0.x and main branches.

To Reproduce
Configure a project with Spring Security 7.1.1
Configure SAML with an override for the Saml2AuthenticationRequestRepository:

    @Bean
    public Saml2AuthenticationRequestRepository<?> samlRequestRepository()
    {
        return new CacheSaml2AuthenticationRequestRepository();
    }

Any attempt to log in will result in an IllegalArgumentException being thrown:

java.lang.IllegalArgumentException: relayState must not be null
	at org.springframework.util.Assert.notNull(Assert.java:182)
	at org.springframework.security.saml2.provider.service.web.CacheSaml2AuthenticationRequestRepository.saveAuthenticationRequest(CacheSaml2AuthenticationRequestRepository.java:58)
	at org.springframework.security.saml2.provider.service.web.Saml2WebSsoAuthenticationRequestFilter.sendPost(Saml2WebSsoAuthenticationRequestFilter.java:137)
	at org.springframework.security.saml2.provider.service.web.Saml2WebSsoAuthenticationRequestFilter.doFilterInternal(Saml2WebSsoAuthenticationRequestFilter.java:110)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:385)

Expected behavior
Browser is redirected to IdP

Sample
I could reproduce using https://github.com/spring-projects/spring-security-samples/tree/main/servlet/spring-boot/java/saml2/login by adding the bean definition to Saml2LoginApplication. I did remove the Docker support and used my own entity-id and metadata-uri though.

Analysis
It appears that the fix in commit e25023627941233513b062a0e1ad846e668f99c9 was overwritten in commit 3f05f4d30c35e00218eaee4490471145dbf2a451.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.