SpringSecurity with both flow-based formLogin and saml2Login

General
1

I’m not quite sure if this is even a Vaadin question, but I thought it was worth asking here.

I’ve got a working Vaadin24 (flow) application with both formLogin and saml2Login authentication methods, both working. The saml2 method works via a button on the flow user/password LoginForm.

What I’ve been asked to do is to switch things around so that if a user is not authenticated, instead of redirecting to /login, it should redirect to the saml2 auth page (i.e. /saml2/authenticate/whatever) but keep the username/password form around for administrative use. Note that the usual authentication method would end up making authentication normally transparent for users, as this is an internal corporate application with exactly one acceptable saml2 idp.

The solutions offered by google go nowhere, either resulting in exactly my current situation or saml2 only without any access to the user/password form.

Any suggestions would be most welcome. Thanks!

2

So if I understand you correctly, my first thought would be to make the saml2 authentication the default, but then create a second SecurityFilterChain bean that uses username-based AuthenticationProvider that is only applicable for requests that are trying to access, say /usernamePasswordLogin (use a RequestMatcher for the http.authorizeHttpRequests() call)

1 Like