Support for multiple identity providers is faulty

[ilPittiz]

Having to support multiple IDPs, I pulled the project to make some configuration tests.

I made adjustments to application.yml configuration, e.g.

grails:
    plugin:
        springsecurity:
            saml:
                [...]
                metadata:
                    providers:
                        aliasA: '/path/to/metadata_A.xml'
                [...]

and verified that all metadata, taken singularly, are loaded as expected.

When trying to add all of them at the same time though, e.g.

grails:
    plugin:
        springsecurity:
            saml:
                [...]
                metadata:
                    providers:
                        aliasA: '/path/to/metadata_A.xml'
                        aliasB: '/path/to/metadata_B.xml'
                        aliasC: '/path/to/metadata_C.xml'
                [...]

and with logging enabled on logback.groovy
logger 'org.grails.plugin.springsecurity.saml', DEBUG, ['STDOUT'], true

On application startup I can see on stdout

Registering metadata key: aliasA and value: /path/to/metadata_A.xml
Registering metadata key: aliasB and value: /path/to/metadata_B.xml
Registering metadata key: aliasC and value: /path/to/metadata_C.xml

but instead, loading https://localhost:8080/metadata/index shows only the idpName of the last provider in the configuration.

Printing a few data on MetadataController.index():

> println metadata.providers    // or metadata.availableProviders
[ org.opensaml.saml2.metadata.provider.FilesystemMetadataProvider@37196d53, 
  org.opensaml.saml2.metadata.provider.FilesystemMetadataProvider@37196d53,
  org.opensaml.saml2.metadata.provider.FilesystemMetadataProvider@37196d53,
  org.opensaml.saml2.metadata.provider.FilesystemMetadataProvider@3e4636c3 ]

> println metadata.providers.collect { metadata.parseProvider(it) }
[ ['ipdNameC'], ['ipdNameC'], ['ipdNameC'], ['spName'] ]

confirms that 3 IDPs were loaded but they're all the very same instance.

Checking the plugin's initializer SpringSecuritySamlGrailsPlugin.groovy#L146, I see there are beans and nested beans' definitions (each with constructor args), but as far as I know beans are singletons by default, so this might be the culprit?