Difficulty setting WantAssertionsSigned in metadata.xml endpoint

[vincentwoo]

ruby-saml tries to decide whether it should set WantsAssertionsSigned on [https://github.com/onelogin/ruby-saml/blob/37368619bf04cfccad9634e79c98e5b9b38d980d/lib/onelogin/ruby-saml/metadata.rb#L33](this line of code). However, the rub here is that it requires idp_cert to be set. If you are writing a SP that integrates with multiple IDPs, it doesn't really make sense for your metadata endpoint (which usually looks something like):

 def metadata
    settings = saml_settings
    meta = OneLogin::RubySaml::Metadata.new
   ...

to know anything about any IDPs at this point in the code flow. Can you let saml-ruby users just say whether they want incoming assertions signed?

[pitbulk]

A settings.security[:want_assertions_signed] could be added.
Can you provide a PR that includes:

• this new setting value (if not set, maintain old behavior)
• A new validator at the response.RB that invalidates any SAMLResponse with no Assertion signed when want_assertion_signed setting active.
• Unit test

[vincentwoo]

No, but can you?

[pitbulk]

I will add this to the pending tasks queue, but can't give you an ETA.