Support signing SAML metadata

[CrazyParanoid]

Closes gh-14801

[jzheaux]

Thanks, @CrazyParanoid! I've left some feedback inline.

[CrazyParanoid]

Hi @jzheaux ! Thanks for your feedback. All your comments have been resolved.

[longgt]

@CrazyParanoid thanks for your contribution.
Regarding to Signing with OpenSAML here, the final hash should be computed right after we did marshal the EntityDescriptor at below method

spring-security/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/metadata/OpenSamlMetadataResolver.java

Line 215 in e92dd02

private String serialize(EntityDescriptor entityDescriptor) {

If we sign EntityDescriptor before calling OpenSamlMetadataResolver.serialize, the marshaller in there will create a brand new XMLSignature object.
It causes the 2 signature elements in below serialized with empty content

<ds:DigestValue/>
<ds:SignatureValue/>

Where it should be

<ds:DigestValue>digest signature</ds:DigestValue>
<ds:SignatureValue>signature value</ds:SignatureValue>

https://github.com/alexo/SAML-2.0/blob/96363df652cff76cd7a04f200a7f58b988b7bfe7/java-opensaml/opensaml-xmlsec-impl/src/main/java/org/opensaml/xml/signature/impl/SignatureMarshaller.java#L99

Beside that, the test case is check only whether DigestValue and SignatureValue is existing or not.
It's better to check whether it contains value or not, in my opinion.

I noted all debug steps at my environment (with Spring Security 6.2.2) here
#13661 (comment)

Please correct if I misunderstood this situation.
Thanks.

[CrazyParanoid]

Hi @longgt ! In the resolveWhenRelyingPartyAndSignMetadataSetThenMetadataMatches test the xml is serialized with:

<ds:DigestValue>K411jmOwS83oyZ5LDpixHzwmvi6dbmd/GAT2sW2Pdyc=</ds:DigestValue>
<ds:SignatureValue>
DQfd3Gl+04LYqDYEk3O7zwuDbA940PAA3F+BVQxSF+7QdmIEykaSL5Kj+kg3DGtpUgbQPwC7SyRz&#13;
hkTZ78v9JzNu1SP8rx5DxyrdRNS51LOQLQP1qFMeSjzEi1TXlHtp0Z35qF2dAycnIty4oZFk2zNk&#13;
Uvm2N1DkAtC5XSqKssI=
</ds:SignatureValue>

I can add a value check to the test, but apparently there is no problem here.

[jzheaux]

Thanks, @CrazyParanoid! This is now merged into main and will go out in the next milestone release.

[jzheaux]

Because I think this may become the default in the future, I made a polish of 6695784 to notify that metadata is unsigned.