Summary
It should be easier to configure the authoritiesExtractor, authoritiesMapper and responseTimeValidationSkew on the OpenSamlAuthenticationProvider.
See gh-7642.
Allowing an authenticationManagerResolver for SAML2 login will allow customizing the OpenSamlAuthenticationProvider.
This should be similar to OAuth2ResourceServerConfigurer.authenticationManagerResolver.