Generate SAMLRequst URL query parameter for unsigned SP-initiated login

[tomcatling]

This adds a minimal SAMLRequest to the login redirect so that SP-initiated login works as expected.

To do:

• add some tests
• check for presence of WantAuthnRequestsSigned="false" in IDP metadata before generating the request (revert to plain redirect if true?)
• make sure the generated request is consistent with output of _make_sp_metadata() and also respects IDP metadata

Developer Certificate of Origin Version 1.1

Copyright (C) 2004, 2006 The Linux Foundation and its contributors. 660 York Street, Suite 102, San Francisco, CA 94110 USA

Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.

Developer's Certificate of Origin 1.1

By making a contribution to this project, I certify that:

(a) The contribution was created in whole or in part by me and I have the right to submit it under the open source license indicated in the file; or

(b) The contribution is based upon previous work that, to the best of my knowledge, is covered under an appropriate open source license and I have the right under that license to submit that work with modifications, whether created in whole or in part by me, under the same open source license (unless I am permitted to submit under a different license), as indicated in the file; or

(c) The contribution was provided directly to me by some other person who certified (a), (b) or (c) and I have not modified it.

(d) I understand and agree that this project and the contribution are public and that a record of the contribution (including all personal information I submit with it, including my sign-off) is maintained indefinitely and may be redistributed consistent with this project or the open source license(s) involved.

Signed-off-by: Tom Catling [email protected]

[miettal]

if redurect url already has queryparametar, question mark will be appeared twice.

actually google workspace saml include idpid parameter in redirect URL. if that case redirection will fail.