title: Spring Security Saml configuration error with OKTA
body: <p>Might be the question is already answered before but I cant find any answer for my problem so I ask you my question. </p>
  
  <p>I am trying to implement SAML2 based SSO with OKTA. For that purpose I created a dev account at oktapreviw. I downloaded spring securty saml2 example at this link 
  <a href="http://projects.spring.io/spring-security-saml/#quick-start" rel="nofollow noreferrer">http://projects.spring.io/spring-security-saml/#quick-start</a> 
  and by using this link 
  <a href="https://docs.spring.io/spring-security-saml/docs/1.0.x/reference/html/chapter-idp-guide.html#d5e1816" rel="nofollow noreferrer">https://docs.spring.io/spring-security-saml/docs/1.0.x/reference/html/chapter-idp-guide.html#d5e1816</a> </p>
  
  <p>I adopted my configuration and this is working perfectly on localhost</p>
  
  <p>Now we come to real world and I tried to configure on test environment. On test environement we have linux server with HAProxy installed as web server and behind haproxy we have our Service provider running on Tomcat. </p>
  
  <p>For the time being we are using autosigned certificate for our haproxy. But now my project is not working and it gives me error :</p>
  
  <p><a href="https://i.stack.imgur.com/H9iTb.png" rel="nofollow noreferrer">org.springframework.security.authentication.AuthenticationServiceException: Incoming SAML message is invalid</a></p>
  
  <p>My configuration in SecurityContext.xml is :</p>
  
  <blockquote>
    
  </blockquote>
  
  <pre><code>&lt;!-- Enable auto-wiring --&gt;
  &lt;context:annotation-config/&gt;
  
  &lt;!-- Scan for auto-wiring classes in spring saml packages --&gt;
  &lt;context:component-scan base-package="org.springframework.security.saml"/&gt;
  
  &lt;!-- Unsecured pages --&gt;
  &lt;security:http security="none" pattern="/favicon.ico"/&gt;
  &lt;security:http security="none" pattern="/images/**"/&gt;
  &lt;security:http security="none" pattern="/css/**"/&gt;
  &lt;security:http security="none" pattern="/logout.jsp"/&gt;
  &lt;security:http security="none" pattern="/ids/serveur/**"/&gt;
  &lt;security:http security="none" pattern="/ids/geoportal/**"/&gt;
  &lt;security:http security="none" pattern="/rest/static/**"/&gt;
  
  &lt;!-- Security for the administration UI --&gt;
  &lt;security:http pattern="/saml/web/**" use-expressions="false"&gt;
      &lt;security:access-denied-handler error-page="/saml/web/metadata/login"/&gt;
      &lt;security:form-login login-processing-url="/saml/web/login" login-page="/saml/web/metadata/login" default-target-url="/saml/web/metadata"/&gt;
      &lt;security:intercept-url pattern="/saml/web/metadata/login" access="IS_AUTHENTICATED_ANONYMOUSLY"/&gt;
      &lt;security:intercept-url pattern="/saml/web/**" access="ROLE_ADMIN"/&gt;
      &lt;security:custom-filter before="FIRST" ref="metadataGeneratorFilter"/&gt;
  &lt;/security:http&gt;
  
  &lt;!-- Secured pages with SAML as entry point --&gt;
  &lt;security:http entry-point-ref="samlEntryPoint" use-expressions="false"&gt;
      &lt;security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY"/&gt;
      &lt;security:custom-filter before="FIRST" ref="metadataGeneratorFilter"/&gt;
      &lt;security:custom-filter after="BASIC_AUTH_FILTER" ref="samlFilter"/&gt;
  &lt;/security:http&gt;
  
  &lt;!-- Filters for processing of SAML messages --&gt;
  &lt;bean id="samlFilter" class="org.springframework.security.web.FilterChainProxy"&gt;
      &lt;security:filter-chain-map request-matcher="ant"&gt;
          &lt;security:filter-chain pattern="/saml/login/**" filters="samlEntryPoint"/&gt;
          &lt;security:filter-chain pattern="/saml/logout/**" filters="samlLogoutFilter"/&gt;
          &lt;security:filter-chain pattern="/saml/metadata/**" filters="metadataDisplayFilter"/&gt;
          &lt;security:filter-chain pattern="/saml/SSO/**" filters="samlWebSSOProcessingFilter"/&gt;
          &lt;security:filter-chain pattern="/saml/SSOHoK/**" filters="samlWebSSOHoKProcessingFilter"/&gt;
          &lt;security:filter-chain pattern="/saml/SingleLogout/**" filters="samlLogoutProcessingFilter"/&gt;
          &lt;security:filter-chain pattern="/saml/discovery/**" filters="samlIDPDiscovery"/&gt;
      &lt;/security:filter-chain-map&gt;
  &lt;/bean&gt;
  
  &lt;!-- Handler deciding where to redirect user after successful login --&gt;
  &lt;bean id="successRedirectHandler"
        class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler"&gt;
      &lt;property name="defaultTargetUrl" value="/"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Use the following for interpreting RelayState coming from unsolicited response as redirect URL:
  &lt;bean id="successRedirectHandler" class="org.springframework.security.saml.SAMLRelayStateSuccessHandler"&gt;
     &lt;property name="defaultTargetUrl" value="/" /&gt;
  &lt;/bean&gt;
  --&gt;
  
  &lt;!-- Handler deciding where to redirect user after failed login --&gt;
  &lt;bean id="failureRedirectHandler"
        class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"&gt;
      &lt;property name="useForward" value="true"/&gt;
      &lt;property name="defaultFailureUrl" value="/error.jsp"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Handler for successful logout --&gt;
  &lt;bean id="successLogoutHandler" class="org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler"&gt;
      &lt;property name="defaultTargetUrl" value="/logout.jsp"/&gt;
  &lt;/bean&gt;
  
  &lt;security:authentication-manager alias="authenticationManager"&gt;
      &lt;!-- Register authentication manager for SAML provider --&gt;
      &lt;security:authentication-provider ref="samlAuthenticationProvider"/&gt;
      &lt;!-- Register authentication manager for administration UI --&gt;
      &lt;security:authentication-provider&gt;
          &lt;security:user-service id="adminInterfaceService"&gt;
              &lt;security:user name="admin" password="admin" authorities="ROLE_ADMIN"/&gt;
          &lt;/security:user-service&gt;
      &lt;/security:authentication-provider&gt;
  &lt;/security:authentication-manager&gt;
  
  &lt;!-- Logger for SAML messages and events --&gt;
  &lt;bean id="samlLogger" class="org.springframework.security.saml.log.SAMLDefaultLogger"/&gt;
  
  &lt;!-- Central storage of cryptographic keys --&gt;
  &lt;bean id="keyManager" class="org.springframework.security.saml.key.JKSKeyManager"&gt;
      &lt;constructor-arg value="classpath:security/samlKeystore.jks"/&gt;
      &lt;constructor-arg type="java.lang.String" value="nalle123"/&gt;
      &lt;constructor-arg&gt;
          &lt;map&gt;
              &lt;entry key="apollo" value="nalle123"/&gt;
          &lt;/map&gt;
      &lt;/constructor-arg&gt;
      &lt;constructor-arg type="java.lang.String" value="apollo"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Entry point to initialize authentication, default values taken from properties file --&gt;
  &lt;bean id="samlEntryPoint" class="org.springframework.security.saml.SAMLEntryPoint"&gt;
      &lt;property name="defaultProfileOptions"&gt;
          &lt;bean class="org.springframework.security.saml.websso.WebSSOProfileOptions"&gt;
              &lt;property name="includeScoping" value="false"/&gt;
          &lt;/bean&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  
  &lt;!-- IDP Discovery Service --&gt;
  &lt;bean id="samlIDPDiscovery" class="org.springframework.security.saml.SAMLDiscovery"&gt;
      &lt;property name="idpSelectionPath" value="/WEB-INF/security/idpSelection.jsp"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Filter automatically generates default SP metadata --&gt;
  &lt;bean id="metadataGeneratorFilter" class="org.springframework.security.saml.metadata.MetadataGeneratorFilter"&gt;
      &lt;constructor-arg&gt;
          &lt;bean class="org.springframework.security.saml.metadata.MetadataGenerator"&gt;
              &lt;property name="extendedMetadata"&gt;
                  &lt;bean class="org.springframework.security.saml.metadata.ExtendedMetadata"&gt;
                      &lt;property name="idpDiscoveryEnabled" value="false"/&gt;
                  &lt;/bean&gt;
              &lt;/property&gt;
          &lt;/bean&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  &lt;!-- The filter is waiting for connections on URL suffixed with filterSuffix and presents SP metadata there --&gt;
  &lt;bean id="metadataDisplayFilter" class="org.springframework.security.saml.metadata.MetadataDisplayFilter"/&gt;
  
  &lt;!-- Configure HTTP Client to accept certificates from the keystore for HTTPS verification --&gt;
  
  &lt;bean class="org.springframework.security.saml.trust.httpclient.TLSProtocolConfigurer"&gt;
      &lt;property name="sslHostnameVerification" value="default"/&gt;
  &lt;/bean&gt;
  
  
  &lt;!-- IDP Metadata configuration - paths to metadata of IDPs in circle of trust is here --&gt;
  &lt;bean id="metadata" class="org.springframework.security.saml.metadata.CachingMetadataManager"&gt;
      &lt;constructor-arg&gt;
          &lt;list&gt;
              &lt;!-- Example of classpath metadata with Extended Metadata --&gt;
              &lt;bean class="org.springframework.security.saml.metadata.ExtendedMetadataDelegate"&gt;
                  &lt;constructor-arg&gt;
                      &lt;bean class="org.opensaml.saml2.metadata.provider.ResourceBackedMetadataProvider"&gt;
                          &lt;constructor-arg&gt;
                              &lt;bean class="java.util.Timer"/&gt;
                          &lt;/constructor-arg&gt;
                          &lt;constructor-arg&gt;
                              &lt;bean class="org.opensaml.util.resource.ClasspathResource"&gt;
                                  &lt;constructor-arg value="/metadata/okta.xml"/&gt;
                              &lt;/bean&gt;
                          &lt;/constructor-arg&gt;
                          &lt;property name="parserPool" ref="parserPool"/&gt;
                      &lt;/bean&gt;
                  &lt;/constructor-arg&gt;
                  &lt;constructor-arg&gt;
                      &lt;bean class="org.springframework.security.saml.metadata.ExtendedMetadata"&gt;
                      &lt;/bean&gt;
                  &lt;/constructor-arg&gt;
              &lt;/bean&gt;
              &lt;!-- Example of HTTP metadata without Extended Metadata --&gt;
              &lt;bean class="org.opensaml.saml2.metadata.provider.HTTPMetadataProvider"&gt;
                  &lt;!-- URL containing the metadata --&gt;
                  &lt;constructor-arg&gt;
                      &lt;value type="java.lang.String"&gt;https://dev-880700.oktapreview.com/app/exkdlhbscqPei3k6d0h7/sso/saml/metadata&lt;/value&gt;
                  &lt;/constructor-arg&gt;
                  &lt;!-- Timeout for metadata loading in ms --&gt;
                  &lt;constructor-arg&gt;
                      &lt;value type="int"&gt;15000&lt;/value&gt;
                  &lt;/constructor-arg&gt;
                  &lt;property name="parserPool" ref="parserPool"/&gt;
              &lt;/bean&gt;
              &lt;!-- Example of file system metadata without Extended Metadata --&gt;
              &lt;!--
              &lt;bean class="org.opensaml.saml2.metadata.provider.FilesystemMetadataProvider"&gt;
                  &lt;constructor-arg&gt;
                      &lt;value type="java.io.File"&gt;/usr/local/metadata/idp.xml&lt;/value&gt;
                  &lt;/constructor-arg&gt;
                  &lt;property name="parserPool" ref="parserPool"/&gt;
              &lt;/bean&gt;
              --&gt;
          &lt;/list&gt;
      &lt;/constructor-arg&gt;
      &lt;!-- OPTIONAL used when one of the metadata files contains information about this service provider --&gt;
      &lt;!-- &lt;property name="hostedSPName" value=""/&gt; --&gt;
      &lt;!-- OPTIONAL property: can tell the system which IDP should be used for authenticating user by default. --&gt;
      &lt;!-- &lt;property name="defaultIDP" value="http://localhost:8080/opensso"/&gt; --&gt;
  &lt;/bean&gt;
  
  &lt;!-- SAML Authentication Provider responsible for validating of received SAML messages --&gt;
  &lt;bean id="samlAuthenticationProvider" class="org.springframework.security.saml.SAMLAuthenticationProvider"&gt;
      &lt;!-- OPTIONAL property: can be used to store/load user data after login --&gt;
      &lt;!--
      &lt;property name="userDetails" ref="bean" /&gt;
      --&gt;
  &lt;/bean&gt;
  
  &lt;!-- Provider of default SAML Context --&gt;
  &lt;bean id="contextProvider" class="org.springframework.security.saml.context.SAMLContextProviderImpl"/&gt;
  
  &lt;!-- Processing filter for WebSSO profile messages --&gt;
  &lt;bean id="samlWebSSOProcessingFilter" class="org.springframework.security.saml.SAMLProcessingFilter"&gt;
      &lt;property name="authenticationManager" ref="authenticationManager"/&gt;
      &lt;property name="authenticationSuccessHandler" ref="successRedirectHandler"/&gt;
      &lt;property name="authenticationFailureHandler" ref="failureRedirectHandler"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Processing filter for WebSSO Holder-of-Key profile --&gt;
  &lt;bean id="samlWebSSOHoKProcessingFilter" class="org.springframework.security.saml.SAMLWebSSOHoKProcessingFilter"&gt;
      &lt;property name="authenticationManager" ref="authenticationManager"/&gt;
      &lt;property name="authenticationSuccessHandler" ref="successRedirectHandler"/&gt;
      &lt;property name="authenticationFailureHandler" ref="failureRedirectHandler"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Logout handler terminating local session --&gt;
  &lt;bean id="logoutHandler"
        class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"&gt;
      &lt;property name="invalidateHttpSession" value="false"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Override default logout processing filter with the one processing SAML messages --&gt;
  &lt;bean id="samlLogoutFilter" class="org.springframework.security.saml.SAMLLogoutFilter"&gt;
      &lt;constructor-arg index="0" ref="successLogoutHandler"/&gt;
      &lt;constructor-arg index="1" ref="logoutHandler"/&gt;
      &lt;constructor-arg index="2" ref="logoutHandler"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Filter processing incoming logout messages --&gt;
  &lt;!-- First argument determines URL user will be redirected to after successful global logout --&gt;
  &lt;bean id="samlLogoutProcessingFilter" class="org.springframework.security.saml.SAMLLogoutProcessingFilter"&gt;
      &lt;constructor-arg index="0" ref="successLogoutHandler"/&gt;
      &lt;constructor-arg index="1" ref="logoutHandler"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Class loading incoming SAML messages from httpRequest stream --&gt;
  &lt;bean id="processor" class="org.springframework.security.saml.processor.SAMLProcessorImpl"&gt;
      &lt;constructor-arg&gt;
          &lt;list&gt;
              &lt;ref bean="redirectBinding"/&gt;
              &lt;ref bean="postBinding"/&gt;
              &lt;ref bean="artifactBinding"/&gt;
              &lt;ref bean="soapBinding"/&gt;
              &lt;ref bean="paosBinding"/&gt;
          &lt;/list&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  &lt;!-- SAML 2.0 WebSSO Assertion Consumer --&gt;
  &lt;bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl"/&gt;
  
  &lt;!-- SAML 2.0 Holder-of-Key WebSSO Assertion Consumer --&gt;
  &lt;bean id="hokWebSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerHoKImpl"/&gt;
  
  &lt;!-- SAML 2.0 Web SSO profile --&gt;
  &lt;bean id="webSSOprofile" class="org.springframework.security.saml.websso.WebSSOProfileImpl"/&gt;
  
  &lt;!-- SAML 2.0 Holder-of-Key Web SSO profile --&gt;
  &lt;bean id="hokWebSSOProfile" class="org.springframework.security.saml.websso.WebSSOProfileConsumerHoKImpl"/&gt;
  
  &lt;!-- SAML 2.0 ECP profile --&gt;
  &lt;bean id="ecpprofile" class="org.springframework.security.saml.websso.WebSSOProfileECPImpl"/&gt;
  
  &lt;!-- SAML 2.0 Logout Profile --&gt;
  &lt;bean id="logoutprofile" class="org.springframework.security.saml.websso.SingleLogoutProfileImpl"/&gt;
  
  &lt;!-- Bindings, encoders and decoders used for creating and parsing messages --&gt;
  &lt;bean id="postBinding" class="org.springframework.security.saml.processor.HTTPPostBinding"&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
      &lt;constructor-arg ref="velocityEngine"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="redirectBinding" class="org.springframework.security.saml.processor.HTTPRedirectDeflateBinding"&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="artifactBinding" class="org.springframework.security.saml.processor.HTTPArtifactBinding"&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
      &lt;constructor-arg ref="velocityEngine"/&gt;
      &lt;constructor-arg&gt;
          &lt;bean class="org.springframework.security.saml.websso.ArtifactResolutionProfileImpl"&gt;
              &lt;constructor-arg&gt;
                  &lt;bean class="org.apache.commons.httpclient.HttpClient"&gt;
                      &lt;constructor-arg&gt;
                          &lt;bean class="org.apache.commons.httpclient.MultiThreadedHttpConnectionManager"/&gt;
                      &lt;/constructor-arg&gt;
                  &lt;/bean&gt;
              &lt;/constructor-arg&gt;
              &lt;property name="processor"&gt;
                  &lt;bean class="org.springframework.security.saml.processor.SAMLProcessorImpl"&gt;
                      &lt;constructor-arg ref="soapBinding"/&gt;
                  &lt;/bean&gt;
              &lt;/property&gt;
          &lt;/bean&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  &lt;bean id="soapBinding" class="org.springframework.security.saml.processor.HTTPSOAP11Binding"&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="paosBinding" class="org.springframework.security.saml.processor.HTTPPAOS11Binding"&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Initialization of OpenSAML library--&gt;
  &lt;bean class="org.springframework.security.saml.SAMLBootstrap"/&gt;
  
  &lt;!-- Initialization of the velocity engine --&gt;
  &lt;bean id="velocityEngine" class="org.springframework.security.saml.util.VelocityFactory" factory-method="getEngine"/&gt;
  
  &lt;!-- 
      XML parser pool needed for OpenSAML parsing
  
      WARNING: If customizing a ParserPool implementation See https://shibboleth.net/community/advisories/secadv_20131213.txt
               Specifically the following should be explicitly set to avoid exploits:
  
               1) set pool property 'expandEntityReferences' to 'false'
               2) set feature 'javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING' to true
               3) set feature 'http://apache.org/xml/features/disallow-doctype-decl' to true. This is a Xerces-specific feature,
                  including derivatives such as the internal JAXP implementations supplied with the Oracle and OpenJDK JREs. For
                  other JAXP implementations, consult the documentation for the implementation for guidance on how to achieve a
                  similar configuration.
  --&gt;
  &lt;bean id="parserPool" class="org.opensaml.xml.parse.StaticBasicParserPool" init-method="initialize"/&gt;
  
  &lt;bean id="parserPoolHolder" class="org.springframework.security.saml.parser.ParserPoolHolder"/&gt;
  </code></pre>
  
  <p></p>
  
  <p>Now I have two assumptions :</p>
  
  <ol>
  <li>Whether my auto signed certificate is creating problem for me</li>
  <li>Or I have to declare teh configuration of this auto signed certificate somewhere</li>
  </ol>
  
  <p>For information : I declared the project in haproxy and my pages with no security are accessible via HAProxy. I also tested the solution given in post <a href="https://stackoverflow.com/questions/40620478/spring-saml-incoming-saml-message-is-invalid">Spring-SAML : Incoming SAML message is invalid</a> , but still I have same problem. </p>
  
  <p>Thanks a lot for your help</p>
  
  <p>Ayyaz</p>
  
  <p><strong>EDIT 05 Féverier :</strong> </p>
  
  <p>I tested and here is the information which I can extract the log file : </p>
  
  <blockquote>
    <ul>
    <li>Verification successful for URI "#id51308797331193271793210762"</li>
    <li>The Reference has Type </li>
    <li>Signature validated with key from supplied credential</li>
    <li>Signature validation using candidate credential was successful</li>
    <li>Successfully verified signature using KeyInfo-derived credential</li>
    <li>Attempting to establish trust of KeyInfo-derived credential</li>
    <li>Failed to validate untrusted credential against trusted key</li>
    <li>Successfully validated untrusted credential against trusted key</li>
    <li>Successfully established trust of KeyInfo-derived credential</li>
    <li>Validation of protocol message signature succeeded, message type: {urn:oasis:names:tc:SAML:2.0:protocol}Response</li>
    <li>Authentication via protocol message signature succeeded for context issuer entity ID <a href="http://www.okta.com/exkdlhbscqPei3k6d0h7" rel="nofollow noreferrer">http://www.okta.com/exkdlhbscqPei3k6d0h7</a></li>
    <li>Successfully decoded message.</li>
    <li>Checking SAML message intended destination endpoint against receiver endpoint</li>
    <li>Intended message destination endpoint: <a href="https://dev-XXX.XXX.net/accessids/saml/SSO" rel="nofollow noreferrer">https://dev-XXX.XXX.net/accessids/saml/SSO</a></li>
    <li>Actual message receiver endpoint: <a href="http://dev-XXX.XXX.net/accessids/saml/SSO" rel="nofollow noreferrer">http://dev-XXX.XXX.net/accessids/saml/SSO</a></li>
    <li>SAML message intended destination endpoint '<a href="https://dev-XXX.XXX.net/accessids/saml/SSO" rel="nofollow noreferrer">https://dev-XXX.XXX.net/accessids/saml/SSO</a>' did not match the recipient endpoint '<a href="http://dev-XXX.XXX.net/accessids/saml/SSO" rel="nofollow noreferrer">http://dev-XXX.XXX.net/accessids/saml/SSO</a>'</li>
    <li>Incoming SAML message is invalid
    org.opensaml.xml.security.SecurityException: SAML message intended destination endpoint did not match recipient endpoint
    at org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder.checkEndpointURI(BaseSAMLMessageDecoder.java:217)
    at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:72)
    at org.springframework.security.saml.processor.SAMLProcessorImpl.retrieveMessage(SAMLProcessorImpl.java:105)
    at org.springframework.security.saml.processor.SAMLProcessorImpl.retrieveMessage(SAMLProcessorImpl.java:172)
    at org.springframework.security.saml.SAMLProcessingFilter.attemptAuthentication(SAMLProcessingFilter.java:77)
    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:195)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:166)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.saml.metadata.MetadataGeneratorFilter.doFilter(MetadataGeneratorFilter.java:87)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:212)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:94)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:504)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:620)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:502)
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1132)
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:684)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1533)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1489)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)</li>
    </ul>
  </blockquote>