feat(saml): Local saml encryption config

[enmande]

🎟️ Tracking

PM-42627

📔 Objective

Note

This needs an accompanying change to contributing docs to call out.

• Adds local configuration options for SAML2.0 encryption assertion with SimpleSaml as IdP.
• Off by default.
• dev/saml20-sp-remote.php.example included following the authsources.php configuration and SimpleSaml documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.02%. Comparing base (ff3f403) to head (8a2a031).

Additional details and impacted files

@@                         Coverage Diff                         @@
##           auth/pm-42627/check-assertion-type    #8311   +/-   ##
===================================================================
  Coverage                               64.02%   64.02%           
===================================================================
  Files                                    2472     2472           
  Lines                                  105980   105980           
  Branches                                 9610     9610           
===================================================================
  Hits                                    67858    67858           
  Misses                                  35763    35763           
  Partials                                 2359     2359           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: REQUEST CHANGES

Reviewed a local-development-only change that adds an optional SimpleSAMLphp SP metadata override so the local IdP can encrypt SAML assertions. The new dev/saml20-sp-remote.php.example mirrors the image's built-in template (same required env-var guards, same AssertionConsumerService/SingleLogoutService wiring) and adds assertion.encryption => FALSE with a placeholder certData, so the default is off and no production code paths are touched. The one substantive concern is that the accompanying docker-compose.yml bind mount is unconditional while the mounted file is gitignored and never generated.

Code Review Details

• ⚠️ : Unconditional bind mount of a gitignored, never-generated file — Docker creates an empty directory in its place and the IdP fails to load SP metadata
  • dev/docker-compose.yml:99
• ❓ : The Aspire AppHost idp container mounts only authsources.php, so encrypted assertions cannot be exercised on that dev path — was leaving it out intentional?
  • AppHost/BuilderExtensions.cs:139

[claude]

⚠️ IMPORTANT: This bind mount makes copying the new example file mandatory for every --profile idp user, and the failure mode is silent.

Details and fix

dev/saml20-sp-remote.php is gitignored and nothing creates it. When the host path is missing, the Docker daemon creates an empty directory at dev/saml20-sp-remote.php (default create_host_path: true), which then shadows the image-generated metadata file.

SimpleSAMLphp's flatfile metadata handler passes file_exists() on a directory, then include() fails and it throws Could not load metadata set [saml20-sp-remote] — so SSO breaks for anyone who pulls this branch with an already-working IdP setup, with an error that doesn't point back to the missing file.

Options:

• Ship a tracked default dev/saml20-sp-remote.php (encryption FALSE, placeholder certData) instead of gitignoring it, so the mount always resolves; or
• Add the copy step alongside the existing IdP setup steps in dev/.env.example and util/Seeder/Seeds/docs/regression.md (the "SSO login wiring" list), not only the external contributing docs.

The authsources.php mount has the same shape, but it is required for the IdP to be useful at all, so first-time setup already covers it — this file is optional-by-default yet mounted unconditionally.

[enmande]

Abandoned/unstacked for #8319