Merge pull request #1208 from progressonderwijs/patrick/optionally_check_signature

Add an option to ignore signature validation

Author: fdij

src/ProgressOnderwijsUtils/SingleSignOn/SsoProcessor.cs

@@ -45,6 +45,13 @@ static string EncodeQueryParameter(string key, string value)
     }
 
     public static Maybe<SsoAttributes, string> GetAttributes(string rawSamlResponse, X509Certificate2 certificate)
+        => GetAttributes(rawSamlResponse, certificate, false);
+
+    [Obsolete("This method ignores signature validation and should not be used in production code")]
+    public static Maybe<SsoAttributes, string> GetAttributesWithEvilIgnoreSignatureCheck(string rawSamlResponse, X509Certificate2 certificate)
+        => GetAttributes(rawSamlResponse, certificate, true);
+
+    static Maybe<SsoAttributes, string> GetAttributes(string rawSamlResponse, X509Certificate2 certificate, bool evilIgnoreSignatureCheck)
     {
         byte[] bytes;
         try {
@@ -85,7 +92,7 @@ public static Maybe<SsoAttributes, string> GetAttributes(string rawSamlResponse,
             return Maybe.Error("Public key missing");
         }
 
-        if (!dsig.CheckSignature(key)) {
+        if (!dsig.CheckSignature(key) && !evilIgnoreSignatureCheck) {
             return Maybe.Error("Signature invalid");
         }