feat(saml): SimpleSaml local assertion encryption

[enmande]

🎟️ Tracking

PM-43087

📔 Objective

• Adds the ability to configure SAML2.0 assertion encryption for the local SimpleSaml testing IdP in a standardized way, following the auth sources pattern.
• Gitignores the resultant saml20-sp-remote.php file for local configuration.

Verified via docker compose and Aspire Apphost.

Contributing docs related PR

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This PR is scoped entirely to local development tooling: a new dev/saml20-sp-remote.php.example template that makes SAML 2.0 assertion encryption configurable for the bundled SimpleSAMLphp IdP, matching bind mounts on both the Compose (dev/docker-compose.yml:99) and Aspire (AppHost/BuilderExtensions.cs:141-142) dev paths, and a dev/.gitignore entry for the runtime copy. No key material is committed — the template ships a PASTE_BASE64_DER_CERTIFICATE_HERE placeholder — assertion.encryption defaults to FALSE so existing local IdP behavior is unchanged, the env var names in the template match those the image and both dev paths already use, and the documented openssl command reads dev/identity_server_dev.crt, which is the same certificate the SSO service loads as its SP signing certificate (bitwarden_license/src/Sso/Utilities/ServiceCollectionExtensions.cs:26). No production code, dependency manifests, or new container images are introduced.

Both findings from the earlier review round are resolved at head: the Aspire path now has a matching bind mount, and commit 8218258 corrected it to target metadata/ rather than config/ while dropping the auto-copy in favor of the manual copy procedure that already governs authsources.php.

Code Review Details

No code findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.89%. Comparing base (cb1f141) to head (8218258).

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #8319       +/-   ##
===========================================
+ Coverage   17.70%   63.89%   +46.19%     
===========================================
  Files        1480     2471      +991     
  Lines       64163   105932    +41769     
  Branches     5148     9601     +4453     
===========================================
+ Hits        11359    67684    +56325     
+ Misses      52607    35907    -16700     
- Partials      197     2341     +2144     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[enmande]

Interested in any feedback here.

Docker Compose can't bind to a conditionally-present file. If the file is not present, Compose will make a placeholder directory behind the scenes. This asks us to add another setup step for idp (copy the un-configured example, much like authsources.php) or accept behavior that can be hard to debug later.

We don't have a precedent for this today. I have an idea outlined here, but holding on a gut-check for that approach.

[JaredSnider-Bitwarden]

I agree w/ this approach. Reasoning given bitwarden/contributing-docs#858 (comment)

Thank you for adding this new capability.

[JaredSnider-Bitwarden]

LGTM! Thank you