fix: add SAML response XML digital signature verification to prevent critical auth bypass

[DivyashreeR008]

Summary

Fixes a critical SAML auth bypass vulnerability (CVSS 9.8+). The /saml/acs endpoint was accepting SAMLResponses without verifying the XML digital signature, allowing anyone with a crafted SAMLResponse to impersonate any user.

Root Cause

The SAML ACS handler decoded the base64 SAMLResponse and extracted user attributes via regex directly from the XML string ??? but never validated the <ds:Signature> element.

Fix

• New dependency: xml-crypto + @xmldom/xmldom for XML signature verification
• New env var: SAML_IDP_CERT ??? the IdP's X.509 public certificate (PEM format)
• Signature verification: Before extracting any attributes, the server:
  1. Parses the SAML XML into a DOM document
  2. Locates all <Signature> elements in the xmldsig namespace
  3. Verifies each signature against the configured IdP certificate
  4. Rejects the response if no valid signature is found
• Warning: If SAML_IDP_CERT is unset in production, a warning is logged

Files Changed

File	Change
services/auth-service/index.js	Added SAML signature verification logic
services/auth-service/package.json	Added @xmldom/xmldom and xml-crypto deps
services/auth-service/.env.example	Added SAML_IDP_CERT config entry