Service Provider creation without entity descriptor in config file

[flyinghermit]

• Tries to fetch entity descriptor (aka SP metadata) from remote entity ID endpoint. Requires entity ID to be configured.
• If entity descriptor is not available from remote entity ID endpoint, a default entity descriptor with entity ID, ACS URL and unspecified NameID format will be created. Requires entity ID and ACS URL to be configured.
• New proto field ACSURL (acs_url) is added to accept Assertion Consumer Service URL.

see #34661, https://github.com/gravitational/teleport.e/issues/2692

Manually tested with service providers.

Works only with tctl, Web UI will be updated with another PR.

To test this PR, create a new service provider with the following spec:

kind: saml_idp_service_provider
version: v1
metadata:
  name: sp
spec:
  entity_id: https://example.com/saml/metadata
  acs_url: https://example.com/saml/acs

It should generate entity descriptor with the following XML format:

<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2023-12-10T03:30:20.578Z" entityID="https://example.com/saml/metadata">
      <SPSSODescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2023-12-10T03:30:20.577825Z" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="false" WantAssertionsSigned="true">
        <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
        <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://example.com/saml/acs" index="1"></AssertionConsumerService>
        <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://example.com/saml/acs" index="2"></AssertionConsumerService>
      </SPSSODescriptor>
</EntityDescriptor>

---

Changelog: Added guided SAML entity descriptor creation when entity descriptor XML is not yet available.

[bl-nero]

The code looks good, but I was unable to properly test it (my local Teleport suddenly stopped receiving features from Sales Center and I can't force it to enable SAML).

[flyinghermit]

Friendly ping @r0mant @mdwn

[r0mant]

lgtm with a couple of suggestions

[r0mant]

Should we read response body and include it in the error and/or log it for easier troubleshooting?

[flyinghermit]

I don't think so. Unless the error is from reading invalid xml or metadata type, I doubt response body would add any meaningful information what is not already provided with StatusCode.

[public-teleport-github-review-bot]

@flyinghermit See the table below for backport results.

Branch	Result
branch/v14	Failed