simplesamlphp/saml2 — pull request #29 by DRvanR (2014-12-04 09:13:21+00:00)
Title: [Important] Enforce presence of signature, assertion signature verification

In the Response Processing PR (https://github.com/simplesamlphp/saml2/pull/24) a very important check somehow was missed. This showed up during tests of an implementation where the simplesamlphp/saml2 lib is being used for both SP and IdP functionality.

The check being missed here is that the Response and/or the assertions it contains must be signed, as per [this][1] check in simplesamlphp. Test cases covering this have been added, as well as that it has been tested in our applications. No additional tests for signature verification have been added as that is already covered.

[1]: https://github.com/simplesamlphp/simplesamlphp/blob/d9dc7c0f9669c483dcf969a58588c429ebb4993b/modules/saml/lib/Message.php#L552-L556