Skip certain path on Spring SAML SSO - spring-security

Question

The web site contextPath is root, http://localhost:8080, use Spring security SAML implemented single sign on. Whatever the url enter under the localhost:8080 root path, it will direct to IDP provider for authentication which is correct so far.
What I want is under localhost:8080/unsecure directory, users can access without need to redirect to IDP for authentication. I don't know where to configure to tell SAML skip certain path.

Answer 1

In your security-applicationContext.xml file you must have mapped urls something like this while configuring spring-security-saml:
<!-- Unsecured pages -->
<security:http security="none" pattern="/favicon.ico"/>
<security:http security="none" pattern="/images/**"/>
<security:http security="none" pattern="/css/**"/>
<security:http security="none" pattern="/logout.jsp"/>
<!-- Security for the administration UI -->
<security:http pattern="/saml/web/**" use-expressions="false">
<security:access-denied-handler error-page="/saml/web/metadata/login"/>
<security:form-login login-processing-url="/saml/web/login" login-page="/saml/web/metadata/login" default-target-url="/saml/web/metadata"/>
<security:intercept-url pattern="/saml/web/metadata/login" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
<security:intercept-url pattern="/saml/web/**" access="ROLE_ADMIN"/>
<security:custom-filter before="FIRST" ref="metadataGeneratorFilter"/>
</security:http>
<!-- Secured pages with SAML as entry point -->
<security:http entry-point-ref="samlEntryPoint" use-expressions="false">
<security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY"/>
<security:custom-filter before="FIRST" ref="metadataGeneratorFilter"/>
<security:custom-filter after="BASIC_AUTH_FILTER" ref="samlFilter"/>
</security:http>
Here we have allowed images, css, favicon etc to be available without login. So add more URLs to the unsecured mapping list if you want it to be available without authentication.