SAML Toolkit support

[woodseowl]

Implementation of the SAML PHP Toolkit for authentication management. This largely follows the ApacheShib code and is swappable for it in routing.

This PR does the following

• Adds SAML PHP Toolkit (a.k.a onelogin/php-saml) library
• Creates a default php-saml config with SP + IdP settings appropriate for Cornell
• Adds routes, middleware, and controllers to support PHP Saml, supported by a SamlIdentityManager class
• Adds adds IdP cert retrieval + SP keypair generation
• Updates installation and testing of the Starterkit accordingly
• Refactors ApacheShib to use manager pattern

At this time, the php-saml configuration does not support ID select

[woodseowl]

Currently sucessfully in use on WA Review, IT Gov, and Daily Check. I think we can merge this.

[woodseowl]

Tried GitHub Copilot code review feature, but apparently it doesn't do PHP :(

[Copilot]

Pull Request Overview

This PR implements support for the SAML PHP Toolkit (OneLogin/php-saml) as an alternative to Apache mod_shib for single sign-on authentication. The implementation follows a manager pattern that allows swapping between authentication methods via configuration.

• Adds SAML PHP Toolkit library and configuration with SP/IdP settings for Cornell
• Refactors existing Apache Shibboleth code to use a manager pattern for pluggable authentication
• Adds certificate management commands and routes for SAML metadata/authentication endpoints

Reviewed Changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/Feature/InstallStarterKitTest.php	Updates test to use new base path method and adds tests for SAML config and certificate installation
tests/Feature/CUAuth/ShibIdentityManagerTest.php	Refactors Apache Shib tests to use new ShibIdentityManager class
tests/Feature/CUAuth/SamlIdentityManagerTest.php	New test file for SAML identity manager functionality
tests/Feature/CUAuth/AppTestersTest.php	Updates tests to inject identity manager dependency
src/StarterKitServiceProvider.php	Adds SAML configuration and certificate generation to install options
src/CUAuth/routes.php	Adds new SSO routes for SAML endpoints and maintains legacy routes
src/CUAuth/SHIBBOLETH.md	Updates documentation for server configuration with clearer structure
src/CUAuth/README.md	Major documentation update explaining both authentication methods
src/CUAuth/Middleware/ForceHttps.php	New middleware to enforce HTTPS connections
src/CUAuth/Middleware/CUAuth.php	Refactored from ApacheShib to use pluggable identity managers
src/CUAuth/Middleware/AppTesters.php	Updates to use identity manager interface
src/CUAuth/Managers/ShibIdentityManager.php	New manager class implementing Apache Shibboleth authentication
src/CUAuth/Managers/SamlIdentityManager.php	New manager class implementing SAML PHP Toolkit authentication
src/CUAuth/Managers/IdentityManager.php	Interface defining identity manager contract
src/CUAuth/Listeners/AuthorizeUser.php	Updates to work with new identity manager pattern
src/CUAuth/Http/Controllers/AuthController.php	Refactored to use identity managers for login/logout/metadata
src/CUAuth/Events/CUAuthenticated.php	Makes remoteUser parameter optional
src/CUAuth/DataObjects/ShibIdentity.php	Removed - functionality moved to managers
src/CUAuth/DataObjects/RemoteIdentity.php	New data object for remote user identity
src/CUAuth/Commands/GenerateKeys.php	New command for generating SAML certificates
src/CUAuth/CUAuthServiceProvider.php	Adds SAML config and identity manager service binding
config/php-saml-toolkit.php	New SAML configuration file
config/cu-auth.php	Updates config with identity manager selection and SAML settings
composer.json	Adds OneLogin SAML library dependency
README.md	Updates PHP version reference and CUAuth description

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[woodseowl]

This PR should be closed after making cornell-custom-dev/laravel-cu-auth a dependency. That package should be maintained on its own since it is used by Weill Cornell.

[woodseowl]

PR #73 takes care of making this an external dependency.