Spring Security SAML2 for reactive environment / spring-webflux

Summary

From what I can tell the recently added SAML2 support only supports Spring MVC or more generally servlet based requests. Any plans to add spring-webflux support?

Comment From: Larry-JJ

May I know is there any progress on spring security saml support spring webflux?

Comment From: jzheaux

There has not yet been progress as other items have taken priority.

If several community members start voting for this item, it's something that we could consider moving up the list.

Comment From: rwinch

Another consideration is that we would need a reactive SAML library

Comment From: hofsa

With "Spring Cloud 2020", the module spring-cloud-netflix-zuul has been removed.

Therefore, there is currently no official supported way to implement an API-Gateway with SAML2 support.

Could you recommend any work-arounds for an API-Gateway with SAML2 on the "Spring Cloud 2020" - stack?

Comment From: rwinch

There really isn't an easy workaround. You would need to create an AuthenticationWebFilter that processes the SAMLResponse without blocking.

Comment From: mohanarpit

Just wanted to ask if SAML support is still being considered for spring-webflux. It'll be great to have this officially in spring-security because a lot of Identity Providers use SAML.

Comment From: mraible

a lot of Identity Providers use SAML.

True, but using SAML in 2021 is like using SOAP instead of REST. ;)

Comment From: shahsohil123

There are enough legacy projects out there that still use SAML and there is no way to get around it. It will be nice to have SAML support added at some point.