These work:

• external.authentication.saml.identityProviderMetadataPath = file:/opt/grouper/shibboleth-test.xml
• external.authentication.saml.keystorePath = file:/opt/grouper/keystore
• external.authentication.saml.serviceProviderMetadataPath = file:/opt/grouper/grouper-sp.xml

 

But these do not:

• external.authentication.saml.identityProviderMetadataResource = file:/opt/grouper/shibboleth-test.xml
• external.authentication.saml.keystoreResource = file:/opt/grouper/keystore
• external.authentication.saml.serviceProviderMetadataResource = file:/opt/grouper/grouper-sp.xml

Long boring story, but ultimately has to do with how Spring creates a FileUrlResource instead of a FileSystemResource for the path, while Pac4j treats any UrlResource as an http resource.

Fix would be for Grouper to not use Spring to create the resource, but rather to use the same logic as Pac4j to create them the expected way. But also update the documentation to make the Path options as preferred