Add WantAssertionsSigned

README.md

@@ -125,6 +125,7 @@ type Profile = {
 - `additionalParams`: dictionary of additional query params to add to all requests; if an object with this key is passed to `authenticate`, the dictionary of additional query params will be appended to those present on the returned URL, overriding any specified by initialization options' additional parameters (`additionalParams`, `additionalAuthorizeParams`, and `additionalLogoutParams`)
 - `additionalAuthorizeParams`: dictionary of additional query params to add to 'authorize' requests
 - `identifierFormat`: if truthy, name identifier format to request from identity provider (default: `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`)
+- `wantAssertionsSigned`: if truthy, add `WantAssertionsSigned="true"` to the metadata, to specify that the IdP should always sign the assertions.
 - `acceptedClockSkewMs`: Time in milliseconds of skew that is acceptable between client and server when checking `OnBefore` and `NotOnOrAfter` assertion condition validity timestamps. Setting to `-1` will disable checking these conditions entirely. Default is `0`.
 - `attributeConsumingServiceIndex`: optional `AttributeConsumingServiceIndex` attribute to add to AuthnRequest to instruct the IDP which attribute set to attach to the response ([link](http://blog.aniljohn.com/2014/01/data-minimization-front-channel-saml-attribute-requests.html))
 - `disableRequestedAuthnContext`: if truthy, do not request a specific authentication context. This is [known to help when authenticating against Active Directory](https://github.com/node-saml/passport-saml/issues/226) (AD FS) servers.

src/passport-saml/saml.ts

@@ -131,6 +131,10 @@ class SAML {
       throw new Error("Invalid property: cert must not be empty");
     }
 
+    if (options.wantAssertionsSigned && !options.cert) {
+      throw new Error('"cert" config parameter is required for signed assertions');
+    }
+
     if (!options.path) {
       options.path = "/saml/consume";
     }
@@ -870,8 +874,7 @@ class SAML {
 
       if (assertions.length == 1) {
         if (
-          this.options.cert &&
-          !validSignature &&
+          (this.options.wantAssertionsSigned || (this.options.cert && !validSignature)) &&
           !this.validateSignature(xml, assertions[0], certs!)
         ) {
           throw new Error("Invalid signature");
@@ -902,8 +905,7 @@ class SAML {
         if (decryptedAssertions.length != 1) throw new Error("Invalid EncryptedAssertion content");
 
         if (
-          this.options.cert &&
-          !validSignature &&
+          (this.options.wantAssertionsSigned || (this.options.cert && !validSignature)) &&
           !this.validateSignature(decryptedXml, decryptedAssertions[0], certs!)
         )
           throw new Error("Invalid signature from encrypted assertion");
@@ -1554,6 +1556,10 @@ class SAML {
       metadata.EntityDescriptor.SPSSODescriptor.NameIDFormat = this.options.identifierFormat;
     }
 
+    if (this.options.wantAssertionsSigned) {
+      metadata.EntityDescriptor.SPSSODescriptor["@WantAssertionsSigned"] = true;
+    }
+
     metadata.EntityDescriptor.SPSSODescriptor.AssertionConsumerService = {
       "@index": "1",
       "@isDefault": "true",

src/passport-saml/types.ts

@@ -54,6 +54,7 @@ export interface SamlOptions extends SamlSigningOptions {
   idpIssuer: string;
   audience: string;
   scoping: SamlScopingConfig;
+  wantAssertionsSigned: boolean;
 
   // InResponseTo Validation
   validateInResponseTo: boolean;

test/static/signatures/invalid/response.root-signed.assertion-invalidly-signed-encrypted.xml

@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Destination="https://evil-corp.madness.com/sso/callback" ID="pfx2c999d0d-2dff-61be-105d-14156cefe511" InResponseTo="_e8df3fe5f04237d25670" IssueInstant="2015-08-31T08:54:06+00:00" Version="2.0">
+   <saml:Issuer>https://evil-corp.com</saml:Issuer>
+   <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+      <ds:SignedInfo>
+         <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
+         <ds:Reference URI="#pfx2c999d0d-2dff-61be-105d-14156cefe511">
+            <ds:Transforms>
+               <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
+               <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+            </ds:Transforms>
+            <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+            <ds:DigestValue>wR6vkZVVUxQ1PFRNlcqJMlOzAe8=</ds:DigestValue>
+         </ds:Reference>
+      </ds:SignedInfo>
+      <ds:SignatureValue>droukqPcDviM/zVWBKk7cNLVQLs9qxu7T7S5HixRhZZSqWPI2wMWq8QPeLA1pIRSfKmM4ojUad6dWIvOvsTq5gL1zllJ/LoC1VcQCMoDYyLthUq3uxI67OGbvWbdLoJddM7q7djIzycgrgRU/v4h2gdW0bon5oPHTG65ivScUci7VxQ02TBwf30K2DBdzlSonN0DP0tfYS3jLpRIJMLVuOI6/AlcLxgqTMC1HU4J8fVOiGmkKmtQFTABAzghI8/Lc1FqWWuihnxpOKexUocsK/qggqfLprDMZTxxiGSrLf+zKRO5Ukk1/EEmrtIIbDsmWNMFsLRPsvrGf1GG4vY3Er6T28FndNGQV88ML6m2MFawAx0e4PLklwjeRST/ACVOdqTwL4VYY5T50WT0KBGgSQ4BFl9RjBLwrgshAfmKHCD/51IhxdMi3WvH1StBvLtBnHTmxrpy4T8S4nQ1AEPZp0X75aP0jL+EenyziXkqLqctezGC5P787iTZ2u1bDwo3h/bOeLii0XHIvG/XT1deEW2d6TyWUEpDM/W2E5FZs2EP6LCpVInIkj1GrCRAQBojtax2u/ZGdLFSSM9wFsAhULCH3V0RfUOHZUhQvzLnfns37CRlkkUdrFc5uFGbVCETikJP5/NGK92qvZDMismS3MSv+GQtK7o1J1psHE0VtY8=</ds:SignatureValue>
+      <ds:KeyInfo>
+         <ds:X509Data>
+            <ds:X509Certificate>MIIEsDCCApigAwIBAgIBADANBgkqhkiG9w0BAQUFADATMREwDwYDVQQDEwgxMC4wLjEuNDAeFw0xNDA1MDgwMDU0MTlaFw0xNDA1MDgwMDU0MTlaMBMxETAPBgNVBAMTCDEwLjAuMS40MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5hqjaroJpB+aR8FME7hQ9nMV0h7MpKtmgFLcK3vwP67feAK+xdt17i8RyUhxil9FCFR5K08Wjwo3NiHZqHqEKitw+IJSndjLSsoNgKEIaiFSug2eV1oYElz06DBXTxc8iq/LazndqTUom51Ode9yI9AGa88cDM5iOqq9mhuGuvwuLtoyU78Ld+s1Ea6Mgf7L8M7fZVO7Ncu+FgIzI6Gt035ohYCLBmOoM7o0uj7DcMEvKOMFziwF40wYmyp3hCLlq3qwkM9pTVJltuz0Bt1vqDdrq3kTheA9JHMayRz3I/BZxAV3iRd4hzLKTkegD8ToTGU10Gme+ZAr1w/erc5hVrM0/XBmHQlnI5d31GU/mfIkm0XPTGRSpPy7E+dUvj9djvm/VqDdojf3uuwirGeLMRlO9P/lCerTktW3g27SV8gn3ETm2Mm7rkNqf24KJpDv0tKDosgbdaHr2IEYD4RpqySp8kd25BhzushqKRkS8Xu5t7HAlVSHwiFhuLqrr4dUfkB8kZeM/ycfZLCn7oNUDFdgjGYSVMpakL97sC9slAW4/8UtXXZxLqcyq/YxdpCysPYP1hsAp+VgPC7GI6CyiNojKPOptMqLZRYnViKxlOiWBJBzUBRUVuac8LXrMiDw8btWGa1Gh5vThuFUKsvmRoeuk7eyXEN9J7j6+fTYjnsCAwEAAaMPMA0wCwYDVR0PBAQDAgTwMA0GCSqGSIb3DQEBBQUAA4ICAQDAPFUo0Pga7vB4Ijy9u3qpWLQSCd4xfw8l92iq3JqLVXBx8Gf9XVy6GzbXWIe6pmQIzmom/CWQvh6o7kc0F4y4ftsWfqnq3k0+HcX4Heu1PN2HSnUUPNsk5Adggd3129MHIdfaKb8bSuLJvSMeMaycrmsb+gEF6JFP8kGWOP4xQYjAVODcFbOyAfEuVAhujw0bqlLHT+El4vlfBrtdU+MZztIqQkGDW7cmm86ZGiBr/ga97BCnOCrgZXlrgmia8SmF7Rfa48/Xzh7bDmPfgmHglL5JxhpRX2IoPY5XItmR8IaYKhOBOrO/qercJ6Z3rQ6fIrs8HrYgeTO/uE9ww6WRWCWDaCR4oWDVwjKzGfP1oJtAIQ+UNjOddH5otDawXJRlQWpr72qT7+WOK/yzJhN0xmXDkmt5psMY/CDn4kXMM0xaRpfYOn5Sc1oelQ+hIm8/rHVK/0krhCDOniqj+L/ne2SoyoXYgS6o0NlkNhtTHmjjosE7HV6JfAUgq2D9dq00JO967I3P0VF6F8lcdaq0tovJhKWRjrrigYd756/3aT2B83JWA1RA9niXmrXfnAPZrNCfWvj+X2alUN/izdIqRts0UpWToVUr0ozWgmbmp5ZOGYOQh+lNcAp3V9lOrdbZVSITM47RYGBZaZNDA2PbDzC13MS/EjTEvSkonwtlCg==</ds:X509Certificate>
+         </ds:X509Data>
+      </ds:KeyInfo>
+   </ds:Signature>
+   <samlp:Status>
+      <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
+   </samlp:Status>
+   <saml:EncryptedAssertion>
+      <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Type="http://www.w3.org/2001/04/xmlenc#Element">
+         <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" />
+         <dsig:KeyInfo>
+            <xenc:EncryptedKey>
+               <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5" />
+               <xenc:CipherData>
+                  <xenc:CipherValue>oYxRKP4pk/12EFVZnnDlPJ9yDgmRFf6ZJ5FEcJ81f/8iTBQeSxaZs3uKPo0qiFlvNvdMo2ADTtMja7+yQwNWkRkChd5dnXgPjC8VAZ6T5mt7aN55/cxWYrS6/s8Lir5zOeYGrscf1UKRFINyyIh6mUPgMNavJ2fqyCqYxZH0wZTsJmehvvTZH3OVHTviYPxrw82atsCQ/bOUYeU8qJ8TXn0aG7Ova54bIFxCuaUiX+bH7gy3DTpOHi5KT4k0mSacjmYObVgaw4Y2TH8EyeSHM5dWoSj98b0AFOt4hO+Uel1Tt2qJ0j/nnjrzWwX4wRBH8kpE1ZT1woFm7UO1xFaz7eqs/y+HPpZ3xS7URr29Zf2A4kmw9dYFQGPgjjX76luRDed5Eh3x+ORaxTw86eNnsH3sgi3DMS/mVF9woqR5dZupSetvlhxOlH98NIg158JV7vd4h19lF/Im+QOP/OWI2XFSDwoogI9XILDBGbnhRgVuOzBQSkL5gBlIeGN6stGWe5mLiA5CCuOL0gVYa1PGesPfxf9Q9a9VAr3S+1eRbmXZ4+P17pHzNu0S7H3YOJ8u8/4FmAScNHSxLxG358giDauVdMwxVAErBBMdNf5U8ql+Vu7iWa8aSzc0PFVOULnciChKNOFNGKxe6CPi9BnKyDKf6ew8c1TLc655sgce4JE=</xenc:CipherValue>
+               </xenc:CipherData>
+            </xenc:EncryptedKey>
+         </dsig:KeyInfo>
+         <xenc:CipherData>
+            <xenc:CipherValue>u3YSGWljG8/1oHqj7CC5wycjLYiJA56VSM1fBhCUAle12UtQ/8Yzh8AknNXwfKqfSaJ1ACb7x4bdZKKMxyULCRXvLMJ/uTXI/2RqGb+9oHbt/PszR6k86wAmpfyBBPk3XP43cPQyXXrrrwo67PyeWloYgQ2dk5Bq20zUDqETPLdxDkOVyeCACZWZSUxqpHh/Pm5L0hAX+5gxGCKSGfNZoZV4Lyne1PHOUm+Yb9o4nBMbSO23svKA1FRfLmDq0BKEs75LZnj50tZB1YPhatjHc9SgCeabRg5JUn+ZTNYIEGhLXnIQ+A7GbkXqkAmqmW80WZyIuyyPUQW5hrWyD+QHytDNf7lDNLNqc7IkIGpetP+hJ26Dd9ZjrZzCzkAWRP4gxq1Oyye5rKRKXtdrcNHOnsGhJvOJjJKfBAwtJlSsY4G/zlQGBWrW4vLh51iRkmemaAO9rUXeNrIgQVh9jL+70RMbPj/KEzwt3RdGUGW2nMXb0H1w0UHmmkJtUdj4pQGQo+N+lB/9HiaVCZ6/fUJQRa0pM1ezd/kVTWvieO+TGmLBwDVAA5pmQmRFsWvkdBF1AT0BEN1wfRnr0ijB4eXKOlUCr9lgHsuLeA8f2SnEDHOOec2bzo2ki4Z8yc7eNSv/fRcmwlBq/6nsHZ6c2RnEnpERDi09+7oTU4GZ4b6FexiLfDuzV8IOWc9wKD1r2tigp+l4S1AGt/3q3M4HaTq00dEoEPjzyMRWv2nkVRNL1wju/AyHBUmoobpRxfHXFbG0Sg2PGYf7qf5QVjOYbQKkziB/xUCjflTJW00lY2nFCVGao4X1EBCMjOMcKQxsMuCQKCLgKlPAvGucpSZ6pkChHUkQoFv0cr1whdxVH9kcRpXHVRG7rkiVhFnDtWe5DLeqKMcz+MgCFDV/om57RZIBnKABgcAohe4LG70QyTnmvqo7FhnReSsYrtUaiVoYhlWGwKYg+taV+6ARHf7GJ4j6VFm4UxYh24F5WVPQRKldwEnTbse8uZSqc+MfBEaGms6GDySvup97Mx21KYRxsR6dOqEM02AzDwmSdJjAL8BZ2muoNnVR+x3kM54YG2n8knCsqVhpPHYaRAKtqtAAMYv74yLfDFkNnwb/nO4hoKbqobEcHgAHKLtEkwj2T/OfQyqcxW2v6humhZ4xSBsmn73dN1JS7FqNQGrbsb/np/hqUWxzN0fF/MPvPcOeubQ4n2ZYDI9xRK0IlVBLWq4aOBPWvfX+eruwxB5/zw8Tjb8FhRpecymr4j3AQfc5qxNIsMnnM22mDEBC+DJqrFFoH5lnYygF8snoWil+27Zr0kniSusphT6KwO0bNXcXl4XU83WVgrvXYY5+hqtYoiWbgPhlooEliocZoGMFTmenmuOmK8PAT0GHEzj3boiJcrduosJsuTJhB40xYr1uW10aVsNJi3Li+Ffqw4jh0A5+itUxVrPQ8rUxpfFFP/A0eLZBoAgsUu9kWVg0U1nP8tsc3D2E1Rv9PyhVfPkgUueEHD5VqWYLiFIXpqZUJsfa4R+A0TOQC31KLRcLMnpPRn0w5d6l8NYDWvM63olpNFsDRwkOQNZxPuEAKW4xVT0qej6hr5f7W+N+QWB3QzTiXIJmb2RxRfJRKdx8xnIqFkwxKvyKptUga1y3peSiRw4IgTj1zII1U4NNpVqqHaY20IWOdWNEyvwDreaqC5ldjVgLGRzhQMlL7BDnCJulbALf346X3pUi6c90MtVOnTvBol5Cz/5xRJi0B3O+BagpAyOVmWyd/ioZVd2x45i6NaqRRtUBouUCOsQqrDh2uvQMX19dW/akjkKPT5Stt+2tPZmMlNrj+hNACStRaCFyJ9s2SDolRC6aV2Xa7e5z36TEQniXKhPGKDu0WYcZgnOLX1fwhBojuMuKcXTlF1/ShVe6U07aTXU8c4W/DVhgXCi2xwiQDra44mpitU5zjNoUv0kcpAWS7kN3QApsJOqb/5swemT96BVZ6Z09L2ORJLg7nm5ocLpjDp9YqW8Flt90qvwIebPelvqrAea3qVPnXidR8bVURafNHikEEY2R3+bxX5GJ8DFmAjWe3jWHWSvZC3RUJ54QmFYhE9+YA+vQLEDWUXpD/Zrobi0Qut6WxsjEp+bAV71tjV2b8jpfL2SrELcd5AFexafQnez0vpoDnEV90Lqc8lctO+duf1bcrGSoNOcBaMPm/ZwBScC3AQbxp3vvpiuEnMidPTyv1Mq7QJdBjhxdy/t0HeoJAyMqZlA7xcTyyB4PUURJf9CPpSpsxy7nbx07MOhwwsjmlsEd2SflNvJvYNU+nZtIO0RmAE4Um96XWpgPpvy3Jd81lOme7yA30N8oXez1iCNzN+cHwvNGYDIIs3j+aO0Lr9QTFjDhtV3wsMLnwI7BNkC/1I15HF+TaGTJbb+Ykgx4shBLsE63fEK3gRYb3MKCYE9er4k5uTqg+VhgbIibIG7+CI8zItzL7FdUxiDs+9M+35/6spRbx7L1qMPmY+L/I1W5uf0jpjw65hMHNwtepL2j7Uu3+wL5C+VVywsUv8BhYGdlo+aFRzm772PvfZu5EUq1laODwOtOElU07ZbmC7xiTqo9kAZOpDFhvezpLtaUyrg28mHgEGg8k+W4L2avQ5glDvvexpDoQ8+n0WrtAqGdjal8Fs08vTuLkAQPn5Rcc9fhFjerPUJfelrjeNpXw+UrawF9fNQsatnKRI2dAgQzBYOs0PeelIdz60sYTtUkam7NwDWK99ipKb57oO03RFLJXPzjG1XmA9PsAcm3do8ig4Fr/GFWte8FG+Sod8FXX+mpcuMeStuW6USEKR8SAQlL2B1xN2XKMs221yNxEt7FriJlKQ/geFkBRHoi+pgtrEx7QrgcfMwcDroAqXVhdVJ9fr7diH+wvcBMFGwspuKjdo076V6BivTKN2kbMkCSztgfd/7HdtL9tKbCLtPLmPyDYhNAD7Bd2aezmihN301CGozXa+4dSDkSoiHDYPJHTcAPNe22YkxOATVK0B0w5cDfwEp4Hf0S4jnoP1y8IU1AL8HDw8mIddULJBOCm0yOpLI39Rpe0tndzguhtgn66TJpPcG9WhAt+jEJTTC2mPKFqwTUiFvJtRt4WPak+cmd6cn2ttM/0LrifvuxL0OVK8aITf0TZuuN9Bb3vkR5AxgwpJMo1WRNKncTBP/Au0b1MUzpXTQ4O3+3QJRH8BPjFENaOZorEWdw56u39dCe83g/ypjwhUfLW15ohLpvD+mVSPsynJjTwmDaIYLTcwwaYMdD/b+3Jg7urF5M8Gz8SgzQRuByyxj9A385yKynQ+SFyMRbKWPbHMXSg+hDGr/TyrRU+IuqIdiAfEBLH+CSZlE5YcoP2XhCioIy4mGWfHwEMT0nPEjkLprDuPB/iiPLw1gJAfVUqqduVbi0EFgqe0mWVYccoENukoIqQxEicYiwq/dp7k77Ns4dybJ87r5Cr8wiPHP9gXI2FiQa+zoSKaPGsEXMi2DNXTz6dIJQ963Faz84Mb9vndYvidTAdcbjO9WPhzTkax2cf19X0Vfg47XF7Teb/a/i1ueteZzNOipfFA+0Sdinv5o9GGmuHvug1ZnmCrNETYiygySUq7efh5QRhGtTCQjTHuSeuAYbMK3I2mGPp7Gjwb+ntjkAQtaNxU8RByuq3rDfV13+9+tNW4npnuVqqO4U2v05xjw+s3DdDrstvhcxawHm/buHnmAbd2L4VjDsF3lGxejy4wKNMheDC2ALJFQ1y2N7h0HOZLZzI1U/cmGJv2WknQhp89nqbQulm+t6zrL9fy0oiD8UGOcLk2da8PU4ilOIRSTC1pB5VN480deQZ14lyKNh1M9J4Cpi3HSAJ6OqlhIEErj0yqqDRpGMLiEk9HPS9Z38VhoD9i6Vpwc7/UDgJft7HZ5YGkSpRz3MXChukT1gJ5kdlEjSjNn56MSFXoASFkKHaB1KLKlbwUODBVZqEN0wEqEahiV+O8KHNZicF/mT2jPROsMwZPWoZYxIFX0cQtOqD8d8n42kM3NSlK0kgc/vWh7NthLf975DqIRp8zdLdwbWszxodVp3f+T1/l/ICU+yAZZIaY14hqWXsMNaJWyQE1/Ld5htdYBvfr5GJIGgeYnZ/WLxnqtXVmtTllHjzL/Tnae/bMe8XJ/fkCOFxA8iJ1Yu5BkUUSjOkKru2FFlOcWgpYImBjPmEjk6I/rGagcsPjOKjk2DPI8+BV0C2a9f4Du0EV7i6jj2SI4gClGTOuUAriq0yNGExou/vvKs8G8WAYoLa5F5zhWHtiHhi6D7lntOTar5jiJ8fCzVux1DAw==</xenc:CipherValue>
+         </xenc:CipherData>
+      </xenc:EncryptedData>
+   </saml:EncryptedAssertion>
+</samlp:Response>

test/static/signatures/invalid/response.root-signed.assertion-invalidly-signed.xml

@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Destination="https://evil-corp.madness.com/sso/callback" ID="pfx2c999d0d-2dff-61be-105d-14156cefe511" InResponseTo="_e8df3fe5f04237d25670" IssueInstant="2015-08-31T08:54:06+00:00" Version="2.0">
+   <saml:Issuer>https://evil-corp.com</saml:Issuer>
+   <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+      <ds:SignedInfo>
+         <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
+         <ds:Reference URI="#pfx2c999d0d-2dff-61be-105d-14156cefe511">
+            <ds:Transforms>
+               <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
+               <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+            </ds:Transforms>
+            <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+            <ds:DigestValue>wR6vkZVVUxQ1PFRNlcqJMlOzAe8=</ds:DigestValue>
+         </ds:Reference>
+      </ds:SignedInfo>
+      <ds:SignatureValue>droukqPcDviM/zVWBKk7cNLVQLs9qxu7T7S5HixRhZZSqWPI2wMWq8QPeLA1pIRSfKmM4ojUad6dWIvOvsTq5gL1zllJ/LoC1VcQCMoDYyLthUq3uxI67OGbvWbdLoJddM7q7djIzycgrgRU/v4h2gdW0bon5oPHTG65ivScUci7VxQ02TBwf30K2DBdzlSonN0DP0tfYS3jLpRIJMLVuOI6/AlcLxgqTMC1HU4J8fVOiGmkKmtQFTABAzghI8/Lc1FqWWuihnxpOKexUocsK/qggqfLprDMZTxxiGSrLf+zKRO5Ukk1/EEmrtIIbDsmWNMFsLRPsvrGf1GG4vY3Er6T28FndNGQV88ML6m2MFawAx0e4PLklwjeRST/ACVOdqTwL4VYY5T50WT0KBGgSQ4BFl9RjBLwrgshAfmKHCD/51IhxdMi3WvH1StBvLtBnHTmxrpy4T8S4nQ1AEPZp0X75aP0jL+EenyziXkqLqctezGC5P787iTZ2u1bDwo3h/bOeLii0XHIvG/XT1deEW2d6TyWUEpDM/W2E5FZs2EP6LCpVInIkj1GrCRAQBojtax2u/ZGdLFSSM9wFsAhULCH3V0RfUOHZUhQvzLnfns37CRlkkUdrFc5uFGbVCETikJP5/NGK92qvZDMismS3MSv+GQtK7o1J1psHE0VtY8=</ds:SignatureValue>
+      <ds:KeyInfo>
+         <ds:X509Data>
+            <ds:X509Certificate>MIIEsDCCApigAwIBAgIBADANBgkqhkiG9w0BAQUFADATMREwDwYDVQQDEwgxMC4wLjEuNDAeFw0xNDA1MDgwMDU0MTlaFw0xNDA1MDgwMDU0MTlaMBMxETAPBgNVBAMTCDEwLjAuMS40MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5hqjaroJpB+aR8FME7hQ9nMV0h7MpKtmgFLcK3vwP67feAK+xdt17i8RyUhxil9FCFR5K08Wjwo3NiHZqHqEKitw+IJSndjLSsoNgKEIaiFSug2eV1oYElz06DBXTxc8iq/LazndqTUom51Ode9yI9AGa88cDM5iOqq9mhuGuvwuLtoyU78Ld+s1Ea6Mgf7L8M7fZVO7Ncu+FgIzI6Gt035ohYCLBmOoM7o0uj7DcMEvKOMFziwF40wYmyp3hCLlq3qwkM9pTVJltuz0Bt1vqDdrq3kTheA9JHMayRz3I/BZxAV3iRd4hzLKTkegD8ToTGU10Gme+ZAr1w/erc5hVrM0/XBmHQlnI5d31GU/mfIkm0XPTGRSpPy7E+dUvj9djvm/VqDdojf3uuwirGeLMRlO9P/lCerTktW3g27SV8gn3ETm2Mm7rkNqf24KJpDv0tKDosgbdaHr2IEYD4RpqySp8kd25BhzushqKRkS8Xu5t7HAlVSHwiFhuLqrr4dUfkB8kZeM/ycfZLCn7oNUDFdgjGYSVMpakL97sC9slAW4/8UtXXZxLqcyq/YxdpCysPYP1hsAp+VgPC7GI6CyiNojKPOptMqLZRYnViKxlOiWBJBzUBRUVuac8LXrMiDw8btWGa1Gh5vThuFUKsvmRoeuk7eyXEN9J7j6+fTYjnsCAwEAAaMPMA0wCwYDVR0PBAQDAgTwMA0GCSqGSIb3DQEBBQUAA4ICAQDAPFUo0Pga7vB4Ijy9u3qpWLQSCd4xfw8l92iq3JqLVXBx8Gf9XVy6GzbXWIe6pmQIzmom/CWQvh6o7kc0F4y4ftsWfqnq3k0+HcX4Heu1PN2HSnUUPNsk5Adggd3129MHIdfaKb8bSuLJvSMeMaycrmsb+gEF6JFP8kGWOP4xQYjAVODcFbOyAfEuVAhujw0bqlLHT+El4vlfBrtdU+MZztIqQkGDW7cmm86ZGiBr/ga97BCnOCrgZXlrgmia8SmF7Rfa48/Xzh7bDmPfgmHglL5JxhpRX2IoPY5XItmR8IaYKhOBOrO/qercJ6Z3rQ6fIrs8HrYgeTO/uE9ww6WRWCWDaCR4oWDVwjKzGfP1oJtAIQ+UNjOddH5otDawXJRlQWpr72qT7+WOK/yzJhN0xmXDkmt5psMY/CDn4kXMM0xaRpfYOn5Sc1oelQ+hIm8/rHVK/0krhCDOniqj+L/ne2SoyoXYgS6o0NlkNhtTHmjjosE7HV6JfAUgq2D9dq00JO967I3P0VF6F8lcdaq0tovJhKWRjrrigYd756/3aT2B83JWA1RA9niXmrXfnAPZrNCfWvj+X2alUN/izdIqRts0UpWToVUr0ozWgmbmp5ZOGYOQh+lNcAp3V9lOrdbZVSITM47RYGBZaZNDA2PbDzC13MS/EjTEvSkonwtlCg==</ds:X509Certificate>
+         </ds:X509Data>
+      </ds:KeyInfo>
+   </ds:Signature>
+   <samlp:Status>
+      <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
+   </samlp:Status>
+   <saml:Assertion ID="_bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" IssueInstant="2020-09-25T16:00:00+00:00" Version="2.0">
+      <saml:Issuer>https://evil-corp.com</saml:Issuer>
+      <saml:Subject>
+         <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">[email protected]</saml:NameID>
+         <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
+            <saml:SubjectConfirmationData InResponseTo="_e8df3fe5f04237d25670" NotOnOrAfter="2020-09-25T16=7:00:00+00:00" Recipient="https://evil-corp.madness.com/sso/callback" />
+         </saml:SubjectConfirmation>
+      </saml:Subject>
+      <saml:Conditions NotBefore="2020-09-25T16:00:00+00:00" NotOnOrAfter="2020-09-25T17:00:00+00:00" />
+      <saml:AuthnStatement AuthnInstant="2020-09-25T16:00:00+00:00" SessionIndex="_9e315bdf7b1b6732be33c377cf6f5c4f">
+         <saml:AuthnContext>
+            <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
+         </saml:AuthnContext>
+      </saml:AuthnStatement>
+      <saml:AttributeStatement>
+         <saml:Attribute Name="evil-corp.egroupid">
+            <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">[email protected]</saml:AttributeValue>
+         </saml:Attribute>
+         <saml:Attribute Name="evilcorp.givenname">
+            <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Vincent</saml:AttributeValue>
+         </saml:Attribute>
+         <saml:Attribute Name="evilcorp.sn">
+            <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">VEGA</saml:AttributeValue>
+         </saml:Attribute>
+      </saml:AttributeStatement>
+      <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+         <ds:SignedInfo>
+            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+            <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
+            <ds:Reference URI="#_bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb">
+               <ds:Transforms>
+                  <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
+                  <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+               </ds:Transforms>
+               <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
+               <ds:DigestValue>UlVrWcRgUXgqQRuYZNEIhLEYv4oC8Kd5/HAl9Cb/jiQ=</ds:DigestValue>
+            </ds:Reference>
+         </ds:SignedInfo>
+         <ds:SignatureValue>vWCTy3IYpsGMl+RJQKZvCN/zZvMp/mBs7Y4Y3ihq0lnX2PDsJaHLEUPX+WTlQN8e791PDCkk+uIu+X+Y1sOyFxIjD5dAikZA2d3QWDC5mcHqj/gvzeiirAWA06Maw3jvaZlquBhpixFk+6mcbAP33UvqgA0Zkjb2qYq0GrOno+bED1vUl2Os9EQB30phllxP5WuJlhUz5Y+X1WXT7AS6f0haTvkFwdMRbniDdjvMiEBfbITUQfM3K361L4TKlYB2T/NRpXv+zjGx9xAl93s4DFdbUzI3jvkBYHhIsRFURwWP5UyczT9P4uuJIiaLXLnOYAX4ZgxVtyWltJKRUhRlzg==</ds:SignatureValue>
+      </ds:Signature>
+   </saml:Assertion>
+</samlp:Response>