Move SAML SP validation to SAMLSSOServiceProviderManager layer

[darshanasbg]

Proposed changes in this pull request

[List all changes you want to add here. If you fixed an issue, please
add a reference to that issue as well.]

When should this PR be merged

[Please describe any preconditions that need to be addressed before we
can merge this pull request.]

Follow up actions

[List any possible follow-up actions here; for instance, testing data
migrations, software that we need to install on staging and production
environments.]

Checklist (for reviewing)

General

• Is this PR explained thoroughly? All code changes must be accounted for in the PR description.
• Is the PR labeled correctly?

Functionality

• Are all requirements met? Compare implemented functionality with the requirements specification.
• Does the UI work as expected? There should be no Javascript errors in the console; all resources should load. There should be no unexpected errors. Deliberately try to break the feature to find out if there are corner cases that are not handled.

Code

• Do you fully understand the introduced changes to the code? If not ask for clarification, it might uncover ways to solve a problem in a more elegant and efficient way.
• Does the PR introduce any inefficient database requests? Use the debug server to check for duplicate requests.
• Are all necessary strings marked for translation? All strings that are exposed to users via the UI must be marked for translation.

Tests

• Are there sufficient test cases? Ensure that all components are tested individually; models, forms, and serializers should be tested in isolation even if a test for a view covers these components.
• If this is a bug fix, are tests for the issue in place? There must be a test case for the bug to ensure the issue won’t regress. Make sure that the tests break without the new code to fix the issue.
• If this is a new feature or a significant change to an existing feature? has the manual testing spreadsheet been updated with instructions for manual testing?

Security

• Confirm this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.
• Are all UI and API inputs run through forms or serializers?
• Are all external inputs validated and sanitized appropriately?
• Does all branching logic have a default case?
• Does this solution handle outliers and edge cases gracefully?
• Are all external communications secured and restricted to SSL?

Documentation

• Are changes to the UI documented in the platform docs? If this PR introduces new platform site functionality or changes existing ones, the changes should be documented.
• Are changes to the API documented in the API docs? If this PR introduces new API functionality or changes existing ones, the changes must be documented.
• Are reusable components documented? If this PR introduces components that are relevant to other developers (for instance a mixin for a view or a generic form) they should be documented in the Wiki.

[sonarqubecloud]

Quality Gate passed

Issues
8 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

Files not reviewed (1)

• components/identity-core/org.wso2.carbon.identity.core/src/test/resources/testng.xml: Language not supported

[darshanasbg]

The following imports are unused and can be removed:

In RegistrySAMLSSOServiceProviderDAOImpl:

• org.wso2.carbon.registry.core.session.UserRegistry
• org.wso2.carbon.user.api.Tenant
• org.wso2.carbon.user.api.UserStoreException
• org.wso2.carbon.identity.core.CertificateRetriever
• org.wso2.carbon.identity.core.CertificateRetrievingException
• org.wso2.carbon.identity.core.DatabaseCertificateRetriever
• org.wso2.carbon.identity.core.KeyStoreCertificateRetriever
• java.security.cert.X509Certificate
• java.sql.Connection
• java.sql.PreparedStatement
• java.sql.ResultSet
• java.sql.SQLException

In IdentityPersistenceManager:

• org.wso2.carbon.identity.core.dao.SAMLServiceProviderPersistenceManagerFactory
• org.wso2.carbon.identity.core.dao.SAMLSSOServiceProviderDAO

[darshanasbg]

&& !serviceProviderDO.getIssuer().contains(IdentityRegistryResources.QUALIFIER_ID)
This part is not available in the addServiceProvider() validation in the RegistrySAMLSSOServiceProviderDAOImpl.. Is that expected?

[darshanasbg]

Same concern is there for uploadServiceProvider() as well.

[Osara-B]

We added the check to ensure that the qualifier wont be appended again to the issuer value and set in the DO

[darshanasbg]

StringUtils.isBlank(serviceProviderDO.getIssuer() part is not available in the uploadServiceProvider() validation in the RegistrySAMLSSOServiceProviderDAOImpl.

Is that expected?

[Osara-B]

Added the check to ensure the issuer isnt white space