Is the SAML support implemented properly?

When parsing a response from a CAS server's /samlValidate endpoint, this library loads the response into a DOM object and does some basic validation on the data to ensure integrity. But given that SAML has an actual specification for what its request/responses should look like, shouldn't this library be more careful about verifying the response data structure?

I did some research on SOAP and SAML but it's a complication subject area and I'm still not sure on the best approach to this. But I think the current implementation linked above could use some work.

For instance, apparently every SAML response should include an InResponseTo attribute which should match the RequestID attribute that was sent in the request. This library isn't performing that check.

Also, the RequestID and IssueInstant are both hardcoded to some sample values, which is surely incorrect.

Start by reading source/CAS/Client.php around line 2065 and source/CAS.php around line 111, then compare the current parsing and request values with the linked SAML specification. Done would require an agreed approach for validating the response structure, correlating InResponseTo with RequestID, and replacing the hardcoded RequestID and IssueInstant values.