SpringSource/spring-security-saml — pull request #2 by pcl (2012-09-25 06:50:18+00:00)
Title: Support for stateless operation.

Add overridable methods and configuration properties so that WebSSO
service providers can avoid session state. This has only been validated
with the WebSSO profile -- HoK and ECP profiles might still require
statefulness, or expect session state data structures to be available.

Note that avoiding session state implies that you are using an alternate
means to validate SAML return info (e.g., hashes in cookies), or are
comfortable with the potential DoS and replay-attack risks involved.