Okta: SAML 2.0 apps

Problem

Okta apps can use SAML 2.0 (signOnMode: SAML_2_0): the app's single sign-on URL /app/{appName}/{externalKey}/sso/saml accepts the HTTP-Redirect and HTTP-POST bindings, its metadata is served at /app/{externalKey}/sso/saml/metadata and GET /api/v1/apps/{appId}/sso/saml/metadata, and settings.signOn sets the ACS URL, audience, NameID format, response and assertion signing and the algorithms (Okta Management API, https://raw.githubusercontent.com/okta/okta-management-openapi-spec/master/dist/current/management-minimal.yaml; https://help.okta.com/en-us/content/topics/apps/aiw-saml-reference.htm). A user not assigned to the app gets the "403 App Not Assigned" page (https://support.okta.com/help/s/article/App-Sign-on-Error-403-User-attempted-unauthorized-access-to-app). The Okta emulator only speaks OIDC, so a service provider's SAML sign-in through Okta cannot be tested.

#9 proposed a generic identity provider with SAML 2.0 that was reviewed but not merged, and predates the Okta emulator.

Proposal

• SAML 2.0 apps in the Okta emulator: external key, SSO URL with both bindings and IdP-initiated sign-in, metadata on both URLs, and an assertion signed per settings.signOn (issuer http://www.okta.com/{externalKey}, Destination, Recipient, Audience, NameID format, InResponseTo).
• No assertion for a user who is not assigned to the app (the documented 403 page) or not ACTIVE; E0000001 for an app that signs neither the response nor the assertion, which Okta forbids.
• Reuse #9's SAML building blocks (metadata, response and signing, certificate generation), crediting its author.

Implementation

A working version with tests and docs is on a fork branch: https://github.com/Unchallenged-com/emulate/tree/okta-saml-idp. Happy to open a pull request for it.