Retrieve SAML assertion from SAML Response

Hi all,
considering the following scenario

• IdP platform that expose authentication service via SAML 2.0
• Backend Service platform that expose APIs via Oauth2
• Web Application that play the role of Service Provider, that uses IdP service for user authentication and Backend Service Platform APIs for implementing business logic

In this scenario, IdP and Backend Service Platform are trusted and OAuth2 token is generated using SAMLBearer grant type by passing also the assertion included in the response.

The E2E flow works in this way

1. user hits a Web App URL
2. user is redirected to IdP (SP initiated flow)
3. user is authenticated on IdP and redirected to Web Application
4. web application retrieves SAML assertion from the SAML response
5. web application requests an OAuth2 token by using SAMLBearer as grant type and the assertion as value
6. Backend Service Platform checks the SAML Response (signature, encryption etc...) and generates the token
7. web application starts consuming APIs

We were able to succesfully implement the first three steps using simpleSAMLphp v1.13
However, there are no APIs available to get the assertion from the response for step 4 (the getAttributes can only be used to retrieve claims..)

In order to implement the E2E flow, we had to add a method in the following file to retrieve the assertion
• simplesamlphp\vendor\simplesamlphp\saml2\src\SAML2\HTTPPost.php

The assertion is then retireved in
• simplesamlphp\modulerà\saml\www\sp\saml2-acs.php

With this change we were able to complete the flow

I think it make sense to have this as an enhancement, so that the same scenario can be supported out of the box.

Start by reviewing simplesamlphp/vendor/simplesamlphp/saml2/src/SAML2/HTTPPost.php and the assertion retrieval in simplesamlphp/modulerà/saml/www/sp/saml2-acs.php. Compare this with the existing getAttributes behavior and confirm that the assertion can be exposed for the SAML bearer flow without changing the existing authentication steps.