Author: John Paraskevopoulos
Author Date: 2025-04-09 08:31:12 UTC

Figure out protocol for NameIDPolicy from request xmlns

Figures out the namespace for the NameIDPolicy if that's not prepended
as samlp:NameIDPolicy in the tag. If it's mentioned as part of the xmlns
in the tag, or it is mentioned in the parent of NameIDPolicy and it is a
SAML2 protocol (urn:oasis:names:tc:SAML:2.0:protocol) then it should be
accepted as it conforms to the SAML2 spec. `samlp` stands as an alias so
as long as it's defined in the xmlns, the request is valid.
Solves an integration issue with dex OpenID Connect provider
(https://github.com/dexidp/dex)
Adds tests for NameIDPolicy xmlns prediction
Adds more info in saml request parsing error log

Merged from https://code.launchpad.net/~quantifics/canonical-identity-provider/+git/canonical-identity-provider/+merge/483614