Support of signed assertions about saml2

[AndersAbel]

I didn't know that this was allowed (but it is, I checked the specification), but it makes sense as the .NET Framework classes expect all assertions to be signed. There's a bit of a hack in the response processing to bypass signature verification of the assertion. Which is okay according to the specification (Core 5.3), as long as the signature on the response is verified.

I think that it's a good idea to make the assertion signature verification more flexible, but it requires that part of the response processing is redesigned. Specifically I think that Saml2Response.CreateClaims should take a new flag that indicates whether signature verification is required or not.

[atschirren]

When implementing this it would be good to be aware about the breaking parts in signature verification in context of SAML described in this paper (see PDF):
http://www.nds.rub.de/research/publications/BreakingSAML/

[AndersAbel]

Thanks for pointing that out. So far I have just used the existing xml signature verification functionality without any further analysis. If so many of the existing frameworks are vulnerable it is definitely something that has to be looked into.