bergie/passport-saml — pull request #37 by mradamlacey (2014-06-05 18:33:12+00:00)
Title: InResponseTo SubjectConfirmation validation support

This PR is for support for validation the InResponseTo attribute and limited support for the SubjectConfirmation element of a SAML response.

* The `Id` attribute of generated SAML requests are cached in the module when support for the InResponseTo validation is turned on
* This cache of ids is set to expire (default is 8 hours)
* When processing a SAML response, the handler code will now:
* Look for the `InResponseTo` in the root `Response` element and validate that it has been seen before (hit in the cache)
* Look for the `InResponseTo` attribute in the `SubjectConfirmationData` element if supplied. This value must match the top level id and hit the cache as well
* Remove the id from the cache if a response with a matching id has been processed
* Validation for `InResponseTo` is by default false, perhaps it is better to be more restrictive, although this could break existing clients