Update to OpenSAML 5

[marcusdacoregio]

By removing OpenSAML3 support in Spring Security 6 we need to make sure that the OpenSAML dependency versions are updated and are compatible with JDK 17.

See:

• Remove OpenSAML3 support #10556 (comment)

[marcusdacoregio]

@phtyson can you help me understand how OpenSAML 4 is not working with Java 17 (based on this comment)? Our samples are running with Java 17 and Spring Security 6 and it seems to be working fine.

Perhaps a minimal, reproducible sample would be great to check that.

[leshalv]

opensaml4 uses javax, while spring security6 uses Jakarta EE
@marcusdacoregio

[leshalv]

I think opensaml5 should work better with springsecurity6

[marcusdacoregio]

@leshalv I did not find the OpenSAML5 general availability release, can you help me to find it and understand how it would work better with Spring Security 6?

[leshalv]

@leshalv I did not find the OpenSAML5 general availability release, can you help me to find it and understand how it would work better with Spring Security 6?

opensaml5 It is still under development, snapshot, Since the opensaml5 is based on Jakarta EE, it is more suitable for spring security6.

[leshalv]

Pac4j has already started to support opensaml5, which I think is helpful for upgrading reference. pac4j-saml-opensamlv5