Overriding SAML Spring Boot Auto Configuration

Spring Boot generates two @Bean objects for a relying party.

The first is a SecurityFilterChain that configures the application as a relying party. When including spring-security-saml2-service-provider, the SecurityFilterChain looks like:

You will notice that every authenticated user has a ROLE_USER role by default.

//src/main/java/com/packtpub/springsecurity/service/ SecurityConfig.java
@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
       http.authorizeHttpRequests( authz -> authz
                   .requestMatchers("/webjars/**").permitAll()
                &...