Fix for #18243 (CacheSaml2AuthenticationRequestRepository.saveAuthenticationRequest(..) throws IllegalArgumentException) is missing in 7.1.1

[patrick-rosendaal]

Describe the bug
The fix for #18243 is missing in the 7.1.x, 7.0.x and main branches.

To Reproduce
Configure a project with Spring Security 7.1.1
Configure SAML with an override for the Saml2AuthenticationRequestRepository:

    @Bean
    public Saml2AuthenticationRequestRepository<?> samlRequestRepository()
    {
        return new CacheSaml2AuthenticationRequestRepository();
    }

Any attempt to log in will result in an IllegalArgumentException being thrown:

java.lang.IllegalArgumentException: relayState must not be null
	at org.springframework.util.Assert.notNull(Assert.java:182)
	at org.springframework.security.saml2.provider.service.web.CacheSaml2AuthenticationRequestRepository.saveAuthenticationRequest(CacheSaml2AuthenticationRequestRepository.java:58)
	at org.springframework.security.saml2.provider.service.web.Saml2WebSsoAuthenticationRequestFilter.sendPost(Saml2WebSsoAuthenticationRequestFilter.java:137)
	at org.springframework.security.saml2.provider.service.web.Saml2WebSsoAuthenticationRequestFilter.doFilterInternal(Saml2WebSsoAuthenticationRequestFilter.java:110)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:385)

Expected behavior
Browser is redirected to IdP

Sample
I could reproduce using https://github.com/spring-projects/spring-security-samples/tree/main/servlet/spring-boot/java/saml2/login by adding the bean definition to Saml2LoginApplication. I did remove the Docker support and used my own entity-id and metadata-uri though.

Analysis
It appears that the fix in commit e250236 was overwritten in commit 3f05f4d.

[cfcromn]

Hi, I’d like to work on this.

I’ve reproduced the regression locally and confirmed that reading the relay state from the authentication request, as done in the previous fix, resolves the issue. I’ll prepare a PR with a regression test.