Support for unsigned token

[amergey]

No description provided.

[coheigea]

I think that "doNotEnforceAssertionsSigned" should only apply to encrypted assertions. I don't see a use-case for supporting unsigned and unencrypted assertions.

[amergey]

I think that "doNotEnforceAssertionsSigned" should only apply to encrypted assertions. I don't see a use-case for supporting unsigned and unencrypted assertions.

Then maybe the doNotEnforceAssertionSigned in configuration is not necessary at all and replace its "logic" with checks to the token. Assertion signature check whould be disabled when it is crypted and unsigned. What do you think ?

[coheigea]

No, I still think we should always default to requiring a signed token, even if it's encrypted.

[coheigea]

A minor change which I'll do myself is that it should check the signature in all cases (even if not required).