Add option for SAML to validate or ignore invalid X509 Certificates

[strehle]

What version of UAA are you running?

Add option for SAML to allow or recject X509 certificates which are not valid (anymore).

How are you deploying the UAA?

I am deploying the UAA

• locally only using gradlew
• using a bosh release I downloaded from bosh.io
• using cf-release
• using cf-deployment
• as part of a commercial Cloud Foundry distribution
• other (please explain)

What did you do?

Setup various SAML integrations because of testing new SAML library.

Some IdP ignore expired X509, some not.

UAA (test UAA) has invalid certificate and with this the tests somethimes passed, sometimes not.

Azure/Entra has
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/howto-enforce-signed-saml-authentication#configure-saml-request-signature-verification

SAP SCI rejects

KeyCloak rejects

Okta? accepts

What did you expect to see? What goal are you trying to achieve with the UAA?

What did you see instead?

Please include UAA logs if available.