Document that Http-Redirect binding not supported for SAML 2.0 responses

[shawnweeks]

Describe the bug
When setting RelyingPartyRegistrations assertionConsumerServiceBinding to Saml2MessageBinding.REDIRECT we do not consume the "SigAlg" and "Signature" query parameters in the response to validate the SAMLResponse leading to the following error message.

Either the response or one of the assertions is unsigned. Please either sign the response or all of the assertions.

We do set the parameters on the outgoing redirect requests to the IDP as resolved in #7711 so this is basically the flip side of that issue.

To Reproduce
Configure a RelyingPartyRegistrationRepository with assertionConsumerServiceBinding set Saml2MessageBinding.REDIRECT and your IDP set to sign responses but not assertions. In Keycloak I just have the "Sign Documents" option checked but not the "Sign Assertions". If you change the binding to POST everything should work normally with just the document but not assertions signed but on REDIRECT it will fail because the Query Parameter isn't considered.

Expected behavior
Both REDIRECT and POST SAML Response Bindings should work with just the response signed.

Sample

A link to a GitHub repository with a minimal, reproducible sample.

Reports that include a sample will take priority over reports that do not.
At times, we may require a sample, so it is good to try and include a sample up front.

[jzheaux]

Hi, @shawnweeks, thanks for the report.

Setting the ACS binding to REDIRECT is not supported, given that the SAML Specification (line 420) states that it must not be used (emphasis mine):

5. Identity Provider issues to Service Provider
   In step 5, the identity provider issues a message to be delivered by the user agent
   to the service provider. Either the HTTP POST, or HTTP Artifact binding can be used to transfer
   the message to the service provider through the user agent. The message may indicate an error,
   or will include (at least) an authentication assertion. The HTTP Redirect binding MUST NOT be
   used, as the response will typically exceed the URL length permitted by most user agents.

As this question has come up before, I think it would be good to add this detail to the JavaDoc. @shawnweeks, are you able to add a link to this detail in the spec to the RelyingPartyRegistration.Builder#assertionConsumerServiceBInding method?

[spring-projects-issues]

If you would like us to look at this issue, please provide the requested information. If the information is not provided within the next 7 days this issue will be closed.