Fix SAML encrypted assertion handling

[duanemay]

Fix SAML encrypted assertion handling when wantAssertionSigned=true

Problem
The UAA SAML authentication flow had a design flaw where the wantAssertionSigned configuration flag (default: true) would prevent decryption of unsigned SAML responses containing encrypted assertions, even when the encrypted assertions themselves were signed after decryption.

This caused UAA to reject perfectly valid and secure SAML configurations such as:

Microsoft Entra ID configured to encrypt assertions for privacy
Microsoft Entra ID configured to sign assertions for authenticity
UAA configured with default wantAssertionSigned = true
The flaw was in the logic that made decryption conditional on the signature policy flag, rather than evaluating encrypted content first and then applying signature policies.

[Copilot]

Pull request overview

This PR fixes UAA’s SAML authentication flow so that encrypted assertions are decrypted even when the outer Response is unsigned, allowing signature policy to be evaluated against the decrypted assertion(s) (e.g., Entra ID unsigned response + signed, encrypted assertions) instead of blocking decryption based on wantAssertionSigned.

Changes:

• Always decrypt response-level encrypted assertions when present (even if the response itself is unsigned).
• Enforce the “response signed OR all assertions signed” policy after decryption and assertion processing.
• Update/extend unit tests to cover the unsigned-response + encrypted-and-signed-assertion scenario and align expected error messaging.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml4AuthenticationProvider.java	Changes decryption gating to always decrypt when encrypted assertions exist; keeps signature-policy enforcement after assertion processing.
server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml4AuthenticationProviderUnitTests.java	Updates expected failure message and adds a regression test for unsigned response with encrypted signed assertion while wantAssertionSigned=true.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.