When can SAMLConfiguration.Current be null? And since Current is request specific, setting it to a config shouldn’t be a problem, correct? Should it be set before/after specifying the ConfigurationID?
The SAMLConfiguration.Current is intended for deployments with a single SAML configuration. It is null unless it’s either explicitly set or there’s an implicit loading of the saml.config file. If you have a single SAML configuration and its being specified programmatically then you should set the SAMLConfiguration.Current prior to any SAML SSO requests. A good time to do this would be at application start-up.
The SAMLConfiguration.Configurations and SAMLConfiguration.ConfigurationID are intended for multi-tenanted deployments where there’s a SAML configuration per tenant.
It’s a case of either using SAMLConfiguration.Current for a single tenanted deployment or SAMLConfiguration.Configurations and SAMLConfiguration.ConfigurationID for a multi-tenanted deployment. You shouldn’t mix these.
Note that in a recent release we refactored this area so that equivalent properties in the SAMLController class replace these SAMLConfiguration properties. However, the same approach applies.