Spring Security SAML2 and Username Password Login in the same API

Question

I am working on implementing a login feature to secure a REST API in Spring Boot and I am struggling to get both the Username/Password JWT authentication and SAML2 authentication to work at the same time. The configuration I give highest priority to is the one that works no matter what. The goal is to use the SAML Provider as an alternative Identity provider for the service that has an internal authentication flow, then grant a user a JWT regardless if they use SAML or the app's login.

I'm following this example for the SAML, and have built out a username/password JWT grant that is working as well. But they only work independently or when given highest priority.

When I do something with multiple configs like:

@EnableWebSecurity
class MultiConfig {
 @Config
 @Order(1)
 static class JWTConfig extends WebSecurityConfigurerAdapter {
  // working JWT configs
}

@Config
@Order(2) 
static class SAMLConfig extends WebSecurityConfigurerAdapter {
  // working SAML Configs
}


}

The configs work separately, but when combined, Spring Security is only working on whatever has highest priority.

I am working with the new(ish) SAML2 libraries in Spring Security Core as of 5.6.3.

The specific error I'm getting is on a sample endpoint:

@RequestMapping(value = "/valid/saml/landing", method = POST).
String testSaml(Model model, @AuthenticationPrincipal Saml2AuthenticatedPrincipal principal) {
 // Supposed to get user info here
}

When combined and priority is given to Username/Password JWT, the above endpoint says that "principal is null". The ultimate goal is to treat a SAML assertion as an alternative Identity Authentication and grant the user an application JWT.

Answer 1

It turns out, the configs were correct all along and it's a SAML Response redirect issue.

The SAML Response was redirecting to "/" when it should have been redirecting to "/my/saml/endpoint".