[46092] adds idp_sso_service_binding config to ssoe_settings_service

[bramleyjl]

Description of change

This change adds an idp_sso_service_binding setting that changes vets-api's SSOe authentication request service binding from Artifact to POST in order to enable the request to be signed. It also changes the RubySAML gem that is used to generate vets-api's SAML requests to a forked version in order to fix a bug with SAML signing as base gem repository is no longer under active maintainence. A devops change and a vsp infra change have already landed to populate this setting in all environments: local, dev, review, and staging instances will all have the new POST binding while production will keep the Artifact binding until lower environment testing can be performed.

In addition, it includes a Gemfile change to the RubySAML library to fix a bug that was improperly rendering our passed XMLto nil.

I have also removed the deprecated settings.security[:embed_sign] RubySAML setting, the idp_sso_service_binding setting that has been added performs the same function.

Original issue(s)

department-of-veterans-affairs/va.gov-team#46092

Testing

This feature has been disabled by default for localhost, to enable it you will need to set the following settings in your settings.local.yml:

• saml_ssoe.request_signing: true
• saml_ssoe.cert_path: link to this public cert file in your devops repository
• saml_ssoe.key_path: can be found in AWS Parameter store, search for /dsva-vagov/identity-team/dev/ssoe-sp-dev-va-gov-key, download the private key to your config/certs directory in vets-api and link to it here

To test, attempt to authenticate with any CSP through SSOe. You should see a substantially longer SAML payload that includes a signature:

<ds:SignatureValue>TbhUvKTDBFx8St+f2EkK/SarCOvQnZwBrXjjAIqocA6lbu9kVHGU6CPM7CEOBZNbl+c02aMoJoCfqJ1FzSYXDnZOjpcZ3OPtx7tfpoiC6Ua7P4o/vS58uvHzlNxN+h0ZDpreybU39Qy6lSaz2M/mQnjnb3TOGr7qW0kZXmHFQPuHvauxck8HvVbGkTfBmQ3Dwm/vSIb/7iJo0krwNpzsCLKl1+EYzbYEZB/O5ZOYOr9QV+u08P3BwhgyvYvBXZhK/qll1U+clLDD94S1h8eBf2p8Oxk8AW/kxxnSu6mJGBJeCO3KQpDuK21FrTUSwE9v31gJqtAQUopTqPXWHqxxeA==</ds:SignatureValue>

[bramleyjl]

This PR has been updated to include the VA.gov-forked RubySAML library, which has been updated to include the necessary change.

[bosawt]

Looks good!