SamlHttpSecurity.java

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf()
                .disable();
        http
                .addFilterBefore(metadataGeneratorFilter(), ChannelProcessingFilter.class)
                .addFilterAfter(samlFilter(), BasicAuthenticationFilter.class);
        http.authorizeRequests()
                .antMatchers("/")
                    .permitAll()
                .antMatchers("/user")
                    .authenticated().and()
                    .formLogin()
                        .loginPage("/saml/login");
        http.logout()
                .logoutSuccessUrl("/");
    }
}