Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-05 09:47:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove Deprecated OpenSAML 3 Support

Browse Source 
Closes gh-10556
This commit is contained in:
Rob Winch
2022-09-07 13:39:26 -05:00
committed by Josh Cummings
parent 2a487ae7f8
commit 48e31f87e4
25 changed files with 14 additions and 2273 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/modules/ROOT/pages/servlet/saml2/login/overview.adoc
-8
View File
@@ -154,14 +154,6 @@ Instead, such classes as `OpenSamlAuthenticationRequestFactory` and `OpenSamlAut
For example, once your application receives a `SAMLResponse` and delegates to `Saml2WebSsoAuthenticationFilter`, the filter delegates to `OpenSamlAuthenticationProvider`:
[NOTE]
====
For backward compatibility, Spring Security will use the latest OpenSAML 3 by default.
Note, though that OpenSAML 3 has reached it's end-of-life and updating to OpenSAML 4.x is recommended.
For that reason, Spring Security supports both OpenSAML 3.x and 4.x.
If you manage your OpenSAML dependency to 4.x, then Spring Security will select its OpenSAML 4.x implementations.
====
.Authenticating an OpenSAML `Response`
image:{figures}/opensamlauthenticationprovider.png[]
docs/modules/ROOT/pages/whats-new.adoc
+2
View File
@@ -6,6 +6,8 @@ Below are the highlights of the release.
== Breaking Changes
* https://github.com/spring-projects/spring-security/issues/10556[gh-10556] - Remove EOL OpenSaml 3 Support.
Use the OpenSaml 4 Support instead.
* https://github.com/spring-projects/spring-security/issues/8980[gh-8980] - Remove unsafe/deprecated `Encryptors.querableText(CharSequence,CharSequence)`.
Instead use data storage to encrypt values.
* https://github.com/spring-projects/spring-security/issues/11520[gh-11520] - Remember Me uses SHA256 by default