SAML Spring Security session timeout

Question

I have configured SAML SSO which is working fine. When session is expired it gives following in log.

2017-04-15 15:14:16,933 [http-nio-7070-exec-8] INFO  org.springframework.boot.actuate.audit.listener.AuditListener - AuditEvent [timestamp=Sat Apr 15 15:14:16 IST 2017, principal=anonymousUser, type=AUTHORIZATION_FAILURE, data={message=Access is denied, type=org.springframework.security.access.AccessDeniedException}]
2017-04-15 15:14:17,035 [http-nio-7070-exec-8] INFO  org.springframework.security.saml.log.SAMLDefaultLogger - AuthNRequest;SUCCESS;0:0:0:0:0:0:0:1;com.hbo.sso:portal;http://www.okta.com/xxxxxxx;;;

Here is my spring-security.xml

<beans xmlns="http://www.springframework.org/schema/beans"
   xmlns:security="http://www.springframework.org/schema/security"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">

    <import resource="classpath*:applicationContext-saml.xml" />

    <security:http  entry-point-ref="samlEntryPoint" use-expressions="true">
       <security:intercept-url .... />
       /* Logging out user */
       <security:intercept-url pattern="/${myapp.logout.url}" access="permitAll()"/>
    </security:http>

</beans>  

Answer 1

When the session is expired your spring session is cleared automatically, so it throws Access Denied Exception, Solution could be 1. in your spring-security.xml add access denied page redirection details.. e.g.

<security:http > <security:access-denied-handler error-page="/anonymous/accessdeniedpage.jsp"/> </security:http> or 2. If you IDP allows the configuration/redirection page on session time out, then map that to your login page.