Security updates

[MKodde]

Fix the security warnings that are reported by the security checker.

Note that we use the SimpleSAMLphp SAML2 library at version 3.2 until 3.3 is considered stable.

[MKodde]

Interesting, the failing test is broken because of a SAML2 3.2 feature which I am yet to find.

OpenConext-profile/src/OpenConext/Profile/Tests/Entity/AuthenticatedUserTest.php

Lines 141 to 154 in b4a44ee

	public function epti_attribute_cannot_be_set_if_its_value_has_multiple_name_ids_when_creating_an_authenticated_user()
	{
	$this->expectException(RuntimeException::class, 'must be a NameID');
	$assertionWithEpti = $this->getAssertionWithEptiWithTooManyValues();
	$attributeDictionary = $this->getAttributeDictionary();
	$assertionAdapter = $this->mockAssertionAdapterWith(
	AttributeSet::createFrom($assertionWithEpti, $attributeDictionary),
	'abcd-some-value-xyz'
	);
	AuthenticatedUser::createFrom($assertionAdapter, []);
	}

The test works with SAML2 @ 3.1.6 but breaks on 3.2.6.

[MKodde]

Ive been researching the problem. And the SAML2 lib used to have a very explicit check on the correctness of the EPTI attribute. This was added in:

simplesamlphp/saml2@d3b8bb0 (simplesamlphp/saml2#60 and later simplesamlphp/saml2#76)

Then @thijskh made the validation less harsh, by logging the problem instead of throwing an Exception. in this commit: simplesamlphp/saml2@6db9836 which landed in v3.2.3.

In order to be compatible with versions >= v3.2.3 we need to update the test or make SAML2 more strict again.

I'm opting for the first option.

@thijskh can you remember the reason for such a specific test case in the AuthenticatedUserTest.php? Is it something that happens often, having an assertion with more than one EPTI values?

[thijskh]

That should really never happen. Does the commit history not tell anything about it? Otherwise safe to drop it.

[MKodde]

Nope no insights to be found in gitlog. The test is actually more a test of the SAML bundle. Removing the test.