Spring security becomes unusable when OpenSAML is on the module path

[raphw]

Describe the bug
The Saml2LoginConfigurer checks the version of OpenSaml to be of version 5 via:

private static final boolean USE_OPENSAML_5 = Version.getVersion().startsWith("5");

Unfortunately, Version.getVersion() can be null, as it is even marked by annotation. OpenSaml implements by reading the implementation version from the package context. If OpenSAML is placed on the module path, this will be the case as one would need to read the version from the module info instead. I am filing this as a bug in OpenSAML.

As things stand, Spring Security will become unusable when OpenSAML is on the module path for this reason as the class initialization crashes and marks the class as unusable forever.

To Reproduce
Load OpenSAML on the module path and use Spring with it.

Expected behavior
The filter should null-guard the lookup and add a fallback to look up the module version of the OpenSAML module, if OpenSAML is loaded from the module path.

Suggestion:

private static String determineOpenSamlVersion() {
    String version = Version.class.getPackage().getImplementationVersion();
    if (version != null) {
        return version;
    }
    Module module = Version.class.getModule();
    return module.isNamed() ? module.getDescriptor().rawVersion().orElse(null) : null;
}

Note that this will still depend on the module following a naming pattern where the version is included, since OpenSAML is an automatic module, but it is better than failing as things stand.

Sample
Simply run existing tests with OpenSAML on the module path. They will already fail.