REF-26: Validate the SAML signature profile before trusting an assertion signature

[thomasnymand]

Binds the assertion signature to the assertion the SP consumes.

Problem

AssertionValidationService.validateSignature called only SignatureValidator.validate(assertion.getSignature(), credential). That is a raw cryptographic check: it proves that some element in the document was signed with the IdP signing key from the configured metadata, but not that the signature covers the <Assertion> whose subject, attributes and NSIS level the SP then reads. A verifying signature was therefore not on its own sufficient grounds for trusting the identity data in the assertion, which is the core trust check of the authentication flow.

Secondary issue in the same method: assertion.getSignature() is null for an unsigned assertion, so SignatureValidator.validate(null, ...) threw an uncaught NullPointerException (HTTP 500) instead of a validation error. The assertion.isSigned() check that should have caught this ran at the end of validateAssertion, and only when oiosaml.servlet.profile.validation.enabled was true.

Changes

• Run SAMLSignatureProfileValidator before the cryptographic check. It requires exactly one reference, restricts the transforms to enveloped-signature plus canonicalization, rejects Object children, and checks that the reference resolves to the element the signature is a child of — the binding that was missing.
• Guard the signature up front. validateSignature now rejects an unsigned assertion (!isSigned() || signature == null) with an AssertionValidationException before touching it, so signing is enforced unconditionally instead of behind the profile-validation flag.
• Removed the now-unreachable isSigned() check at the end of validateAssertion.

Trust is still anchored where it was: the verification credential is the signing certificate from the configured IdP metadata, and an embedded KeyInfo is not trusted.

Verification

Two regression tests in AssertionValidationServiceTest cover assertions whose signature verifies but is not bound to the element being consumed, one where the consumed assertion has its own ID and one where it reuses the ID of the referenced element. Each test first asserts that the signature still verifies under a raw SignatureValidator.validate, so it cannot pass for the wrong reason, and then asserts that validation rejects the assertion.

Checked in both directions:

• With the production file reverted and the tests kept: both assertions pass validation. That is what this PR fixes.