Allow SPs to have multiple certs (LG-2049)

[zachmargolis]

This PR should let us manage multiple certs per SP.

At a high level:

• SAML requests can be signed by an SP's private cert, and so we detect the cert used and then encrypt the response to the matching cert
• OIDC assertions are signed by a client cert, but the responses are all signed by the IDP's public key so no need to change the response

Next steps:

• Update the identity-idp-config to use the certs (plural)
• Update the dashboard to send the certs (plural) key
• Validate with a real partner that they can use multiple certs with their SP in INT
• Cleanup: Remove usage of singular cert
  • Remove in dashboard
  • Remove in identity-idp-config

[zachmargolis]

this was a very old column and adding it here makes sure we don't reference it at all

[aduth]

this was a very old column and adding it here makes sure we don't reference it at all

Appears we may still be referencing it during local development make setup:

identity-idp/app/services/service_provider_seeder.rb

Line 20 in 5a0fb4c

end.update!(config.except('agency',

identity-idp/config/service_providers.localdev.yml

Line 320 in 5a0fb4c

fingerprint: '08:79:F5:B1:B8:CC:EC:8F:5C:2A:58:03:30:14:C9:E6:F1:67:78:F1:97:E8:3A:88:EB:8E:70:92:25:D2:2F:32'

This is preventing make setup from succeeding:

ActiveModel::UnknownAttributeError: unknown attribute 'fingerprint' for ServiceProvider.
/Users/Documents/Code/identity-idp/app/services/service_provider_seeder.rb:20:in `block in run'
/Users/Documents/Code/identity-idp/app/services/service_provider_seeder.rb:13:in `each'
/Users/Documents/Code/identity-idp/app/services/service_provider_seeder.rb:13:in `run'
/Users/Documents/Code/identity-idp/db/seeds.rb:2:in `<main>'

We do want to remove that configuration value from the second file?

[aduth]

For posterity: #4877

[aduth]

Also, should fingerprint be removed from COLUMNS in NullServiceProvider? Currently it behaves differently between ServiceProvider and NullServiceProvider:

[3] pry(main)> ServiceProvider.new.fingerprint
NoMethodError: undefined method `fingerprint' for #<ServiceProvider:0x00007fad4c15e810>
from /Users/andrewmduthie/.rbenv/versions/2.6.6/lib/ruby/gems/2.6.0/gems/activemodel-6.1.3.1/lib/active_model/attribute_methods.rb:469:in `method_missing'
[7] pry(main)> NullServiceProvider.new(issuer:nil).fingerprint
=> nil

identity-idp/app/models/null_service_provider.rb

Line 23 in e6fafb9

fingerprint

[zachmargolis]

thanks for these catches... will make a PR to remedy

[zachmargolis]

#4884

[stevegsa]

Excellent job!

[solipet]

Looks great - just one question

[orenyk]

Looks good! A few questions below.