您需要的是AuthenticationEntryPoint。AuthenticationEntryPoint是您在需要身份验证时告诉Spring Security重定向到何处的方式。
由于您只需要在需要身份验证时重定向，因此可以像这样使用LoginUrlAuthenticationEntryPoint：

@Bean
SecurityFilterChain app(HttpSecurity http) throws Exception {
    String url = "https://ospa.company.com/adfs/ls/IdpInitiatedSignOn? LoginToRP=urn:microsoft:adfs:claimsxray& RequestedAuthenticationContext=urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport";

    AuthenticationEntryPoint entryPoint = 
            new LoginUrlAuthenticationEntryPoint(url);

    http
        .authorizeHttpRequests((authorize) -> authorize
            .anyRequest().authenticated()
        )
        .saml2Login(withDefaults())
        .exceptionHandling((exceptions) -> exceptions
            .authenticationEntryPoint(entryPoint)
        );
    
    return http.build();
}

字符串
还请确保使用IdP的相应元数据配置应用程序。

以下配置对我有效：

@Configuration
public class SamlConfiguration {

    @Bean
    Saml2AuthenticationRequestResolver authenticationRequestResolver(RelyingPartyRegistrationRepository registrations) {
        RelyingPartyRegistrationResolver registrationResolver = new DefaultRelyingPartyRegistrationResolver(registrations);
        OpenSaml4AuthenticationRequestResolver authenticationRequestResolver = new OpenSaml4AuthenticationRequestResolver(registrationResolver);
        authenticationRequestResolver.setAuthnRequestCustomizer((context) -> context.getAuthnRequest().setRequestedAuthnContext(buildRequestedAuthnContext()));
        return authenticationRequestResolver;
    }

    private RequestedAuthnContext buildRequestedAuthnContext() {
        // Create AuthnContextClassRef
        AuthnContextClassRefBuilder authnContextClassRefBuilder = new AuthnContextClassRefBuilder();
        AuthnContextClassRef authnContextClassRef = authnContextClassRefBuilder.buildObject(SAMLConstants.SAML20_NS, AuthnContextClassRef.DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20_PREFIX);
        authnContextClassRef.setURI(AuthnContext.PPT_AUTHN_CTX);

        // Create RequestedAuthnContext
        RequestedAuthnContextBuilder requestedAuthnContextBuilder = new RequestedAuthnContextBuilder();
        RequestedAuthnContext requestedAuthnContext = requestedAuthnContextBuilder.buildObject();
        requestedAuthnContext.setComparison(AuthnContextComparisonTypeEnumeration.EXACT);
        requestedAuthnContext.getAuthnContextClassRefs().add(authnContextClassRef);

        return requestedAuthnContext;
    }
}

字符串
它生成以下SAML请求：

<saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
                     AssertionConsumerServiceURL="..."
                     Destination="..."
                     ForceAuthn="false"
                     ID="..."
                     IsPassive="false"
                     IssueInstant="..."
                     ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                     Version="2.0"
                     >
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">...</saml2:Issuer>
    <saml2p:RequestedAuthnContext Comparison="exact">
        <saml2:AuthnContextClassRef xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
    </saml2p:RequestedAuthnContext>
</saml2p:AuthnRequest>

型
使用Sping Boot 2.7.17进行测试，包括OpenSAML 4.0.1。