Okta saml2 authentication issue - spring

Question

I'm trying to combine JWT and SAML-based authentication at one server.
My config:
#Configuration
#EnableWebSecurity
#EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends AbstractSecurityConfig implements WebMvcConfigurer {
private static final Logger log = LogManager.getLogger(WebSecurityConfig.class);
private final TokenAuthorizationFilter tokenAuthorizationFilter;
private final AuthenticationEntryPoint authenticationEntryPoint;
private final UserDetailsService userDetailsService;
private final UserService userService;
private final AuthoritiesService authoritiesService;
#Value("${spring.security.saml2.default.roles.on-creation}")
private final List<String> samlDefaultRoles;
private final PasswordEncoder passwordEncoder;
#Value("${security.cors.paths}")
private String corsPaths;
#Value("${security.cors.origins}")
private String corsOrigins;
#Value("${security.cors.methods}")
private String corsMethods;
public WebSecurityConfig(final TokenAuthorizationFilter tokenAuthorizationFilter,
final AuthenticationEntryPoint authenticationEntryPoint,
final UserDetailsService userDetailsService,
final UserService userService,
final AuthoritiesService authoritiesService,
final List<String> samlDefaultRoles,
final PasswordEncoder passwordEncoder) {
this.tokenAuthorizationFilter = tokenAuthorizationFilter;
this.authenticationEntryPoint = authenticationEntryPoint;
this.userDetailsService = userDetailsService;
this.userService = userService;
this.authoritiesService = authoritiesService;
this.samlDefaultRoles = samlDefaultRoles;
this.passwordEncoder = passwordEncoder;
}
#Bean
protected SecurityFilterChain filterChain(final HttpSecurity http) throws Exception {
http.cors()
.and()
.csrf()
.disable()
.authorizeRequests()
.antMatchers(SECURITY_WHITELIST)
.permitAll()
.anyRequest()
.authenticated()
.and()
.httpBasic()
.and()
.exceptionHandling()
.authenticationEntryPoint(authenticationEntryPoint).and().sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS);
http.addFilterBefore(tokenAuthorizationFilter, UsernamePasswordAuthenticationFilter.class);
/*------------------------SAML--------------------------*/
OpenSamlAuthenticationProvider authenticationProvider = new OpenSamlAuthenticationProvider();
authenticationProvider.setResponseAuthenticationConverter(groupsConverter());
http.csrf().disable() //todo !! check
.authorizeHttpRequests(authorize -> authorize
.antMatchers(SECURITY_WHITELIST)
.permitAll()
.anyRequest().authenticated()
)
.saml2Login(saml2 -> saml2
.authenticationManager(new ProviderManager(authenticationProvider))
)
.saml2Login()
.successHandler(successRedirectHandler())
.failureUrl("http://localhost:3000/login/")
.and()
.saml2Logout(withDefaults());
return http.build();
}
#Bean
public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration)
throws Exception {
return authenticationConfiguration.getAuthenticationManager();
}
#Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping(corsPaths)
.allowedOrigins(corsOrigins)
.allowedMethods(corsMethods);
}
#Override
public void addArgumentResolvers(List<HandlerMethodArgumentResolver> resolvers) {
resolvers.add(new OffsetBasedPageableResolver());
}
/*------------------------------------------- SAML configuration -------------------------------------*/
/* #Bean
protected SecurityFilterChain samlFilterChain(final HttpSecurity http) throws Exception {
return http.build();
}*/
#Bean
public SavedRequestAwareAuthenticationSuccessHandler successRedirectHandler() {
SavedRequestAwareAuthenticationSuccessHandler successRedirectHandler =
new SavedRequestAwareAuthenticationSuccessHandler();
successRedirectHandler.setDefaultTargetUrl("/v1/home/");
return successRedirectHandler;
}
private Converter<ResponseToken, Saml2Authentication> groupsConverter() {
Converter<OpenSamlAuthenticationProvider.ResponseToken, Saml2Authentication> delegate =
OpenSamlAuthenticationProvider.createDefaultResponseAuthenticationConverter();
return (responseToken) -> {
Saml2Authentication authentication = delegate.convert(responseToken);
Saml2AuthenticatedPrincipal principal = (Saml2AuthenticatedPrincipal) authentication.getPrincipal();
List<String> authorities = principal.getAttribute(DEFAULT_SAML_ATTRIBUTE_ROLE);
if (authorities == null) {
authorities = samlDefaultRoles;
}
List<SimpleGrantedAuthority> grantedAuthorities = userService.validateUserCreationAndCheckAuthorities(
principal, authorities);
return new Saml2Authentication(principal, authentication.getSaml2Response(), grantedAuthorities);
};
}
}
My goal is to avoid extending deprecated Web
SecurityConfigurerAdapter and implement both stateless and statefull configs. I have no glue how to correctly apply them. Also haven't found descent manual related to the topic. Suggestions?