Add want_assertions_or_response_signed functionality

[skoranda]

Add the ability to configure an SP to require either a signed response
or signed assertions.

[rohe]

LGTM

[jkakavas]

Ideally, I would like us to have tests in https://github.com/rohe/pysaml2/blob/master/tests/test_41_response.py ensuring we discard incorrectly signed responses/assertions with any valid combination of the want_X_signed set

Assuming this is not too much work, I would feel more comfortable having those before we merge this change.

[jkakavas]

I agree with Scott that this is the easiest way forward for now without a major refactoring as this was a breaking change we introduced recently and needs to be fixed.

Down the line, I think we should open an issue and discuss how this can be handled so that we refactor the logic accordingly. My opinion is that administrators don't need the granularity we currently give them. It should be enough to give the option to disable signature verification for testing/development ( with BIG FAT warnings ) and when this is not the case :

• Check if the response is signed.
  • If yes, validate the signature and discard if not valid
  • If no, move on and check if the assertion in the response is signed
    • If yes, validate the signature and discard if not valid
    • If no, discard.

[surfnet-niels]

What is keeping us from merging this? Is it just the conflicts?

[c00kiemon5ter]

Tests is the main reason (same for #483). Conflicts are easily resolved.

[skoranda]

Just a "heads up" that I have rebased my commits off of today's master and spun up my testbed and verified that my commits (after fixing some merge conflicts) still work. I will be attempting to write tests in the next few days.

[codecov-io]

Codecov Report

Merging #485 into master will increase coverage by 0.04%.
The diff coverage is 94.59%.

@@            Coverage Diff             @@
##           master     #485      +/-   ##
==========================================
+ Coverage   65.56%   65.61%   +0.04%     
==========================================
  Files         103      103              
  Lines       25568    25602      +34     
==========================================
+ Hits        16764    16799      +35     
+ Misses       8804     8803       -1

Impacted Files	Coverage Δ
src/saml2/client_base.py	76.86% <ø> (+1.2%)	⬆️
src/saml2/config.py	84.42% <ø> (ø)	⬆️
src/saml2/response.py	72.77% <100%> (+0.68%)	⬆️
src/saml2/entity.py	85.2% <93.75%> (+0.85%)	⬆️
src/saml2/validate.py	74.5% <0%> (-3.93%)	⬇️
src/saml2/__init__.py	86.33% <0%> (-0.19%)	⬇️
src/saml2/sigver.py	71.7% <0%> (+0.11%)	⬆️
src/saml2/time_util.py	87.42% <0%> (+0.59%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 40a3699...8b79846. Read the comment docs.

Resolved