Engineering / ENG-1437
SAML: accept Okta as a depot's identity provider
Description
From the April spike (ENG-1386): our SAML handling refuses Okta's responses before ENG-1439 can do anything with them.
- Okta signs the assertion, not the whole response; we required a signed response.
- Okta's issuer is per app (one app per depot); we expected one issuer per client.
Accept a signed assertion inside an unsigned response, and an issuer per depot. Entra ID depots unchanged.
Merged. Entra ID regression tests green; the local test IdP now has an Okta profile.