Add OpenSamlAssertingPartyDetails

[jzheaux]

Closes gh-10781

[jzheaux]

@OrangeDog, does this meet the use case you identified in this comment:

RelyingPartyRegistrations.fromMetadataLocation only results in a single RelyingPartyRegistration, and the full entity descriptor does not appear to be available from that - e.g. the <EntityAttributes> and <Extensions>.

[OrangeDog]

I assume it does. You guys tested it, right?

It will still need verification of the EntitiesDescriptor signature, especially when SSL is not available.
And ideally the ability to see and use the response's cache details, otherwise both users and the federation host get annoyed with you.

Let me go put some of my code examples on my top-level issue and you can hopefully put together an equivalent example for Spring 5/6.

[jzheaux]

It will still need verification of the EntitiesDescriptor signature, especially when SSL is not available.

In this situation, I think an application can use OpenSAML to verify the signature themselves, for example:

InputStream unverified = // ... retrieve metadata over HTTP
InputStream verified = // ... verify signature using OpenSAML
List<RelyingPartyRegistrations.Builder> registrations = 
        RelyingPartyRegistrations.collectionFromMetadata(verified);

I'm not really inclined to further simplify pulling metadata over a non-TLS endpoint.

That said, I appreciate the insight -- to discuss the merits of Spring Security doing signature verification further, I'd recommend opening a separate ticket to keep this PR focused on #10781.

[marcusdacoregio]

Great @jzheaux. I've left some feedback inline.

[marcusdacoregio]

Suggested change

	* {@link org.springframework.security.saml2.provider.service.registration.OpenSamlAssertingPartyDetails.Builder}
	* {@link org.springframework.security.saml2.provider.service.registration.OpenSamlMetadataAssertingPartyDetailsConverter.AssertingPartyDetails.Builder}

[marcusdacoregio]

Suggested change

	/**
	* Build an
	* {@link org.springframework.security.saml2.provider.service.registration.OpenSamlAssertingPartyDetails}
	* @return
	*/
	/**
	* Build an
	* {@link org.springframework.security.saml2.provider.service.registration.OpenSamlMetadataAssertingPartyDetailsConverter.AssertingPartyDetails}
	* @return the {@link org.springframework.security.saml2.provider.service.registration.OpenSamlMetadataAssertingPartyDetailsConverter.AssertingPartyDetails}
	*/