Add Saml2AuthenticationRequestRepository #9185
Description
Related to #9174
It would be nice to remember the AuthNRequest so that data like InResponseTo can be validated.
To do this will require a new interface that both Saml2WebSsoAuthenticationRequestFilter and Saml2WebSsoAuthenticationFilter can use. The first will store the AuthNRequest and the second will read and remove it.
The interface will look something like this:
public interface Saml2AuthenticationRequestRepository<T extends AbstractSaml2AuthenticationRequest> {
T loadAuthenticationRequest(HttpServletRequest request);
void saveAuthenticationRequest(T authenticationRequest, HttpServletRequest request, HttpServletResponse response);
T removeAuthenticationRequest(HttpServletRequest request, HttpServletResponse response);
}And it should initially have a single implementation HttpSessionSaml2AuthenticationRequestRepository that stores the request in the session.
Saml2AuthenticationToken should also be altered to have a new constructor that takes the RelyingPartyRegistration, the SAML 2.0 response, and the AbstractSaml2AuthenticationRequest loaded from the repository.