Code returns hard instance of HttpURLConnection rather than URLConnection

[richardcs]

spring-framework/spring-web/src/main/java/org/springframework/http/client/SimpleClientHttpRequestFactory.java

Line 187 in b595dc1

URLConnection urlConnection = (proxy != null ? url.openConnection(proxy) : url.openConnection());

As documented here : https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/saml2/provider/service/registration/RelyingPartyRegistrations.html the code should be able to handle classpath:, file: and http: but since it just uses a RestTemplate.getForObject, which delegates to SimpleClientHttpRequestFactory, there is nothing that will work except a http request. Im not sure where to place this issue, but the offending code error is here and the URLConnection is there for the taking. The actual instance returned for file is "sun.net.www.protocol.file.FileURLConnection" which extends URLConnection (https://github.com/frohoff/jdk8u-jdk/blob/master/src/share/classes/sun/net/www/protocol/file/FileURLConnection.java)

[mdeinum]

The RelyingPartyRegistrations uses a ResourceLoader and to be more precise a DefaultResourceLoader. There is no reference in either the RelyingPartyRegistrations nor the DefaultResourceLoader to a RestTemplate.

The DefaultResourceLoader is more than capable of loading file:, classpath: or http(s): based resources.

[rstoyanchev]

Indeed this doesn't seem to be Spring Framework related. @jzheaux do you have any suggestions?

[crazyguyonabike]

This was an issue with 5.4.5. Upgrading to 5.5 the code changed to use the Resource
Loader

[mdeinum]

The documentation linked is for the 5.5.x version, the 5.4.x doesn't have that documentation. Looks like a case of reading uptodate documentation but using an older version instead.

The support for reading files has been added explicitly in 5.5.x (see spring-projects/spring-security#9028), so apparently it wasn't supported before that.

[jzheaux]

@richardcs I agree with @mdeinum's analysis here. If you still feel like this is an issue, please feel free to use Spring Security's issue tracker , and I'd be happy to take a closer look.