SAML 2.0 service provider on OpenSAML - every assertion signed, Redis replay cache (ID3.3)

Shipped: November 15, 2026 at 7:37 AM UTC
Author: Kamo
Commit: 0e0194c

OpenSamlServiceProvider **************** 6.1.5 = Boot 3.1.5's Spring Security, OpenSAML 4.1.1 from the Shibboleth releases repository): SP-initiated AuthnRequest (HTTP-Redirect), response validation with OpenSaml4AuthenticationProvider (signature, issuer, audience, recipient/destination, NotBefore/NotOnOrAfter, InResponseTo) + every assertion must be signed + SETNX replay cache in Redis (fail closed); SP metadata; IdP metadata parse (XXE refused). OpenSAML initialises on first use, never at context start, so a library fault can only cost SAML.

All changes

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.

Start Free Forever View Pricing