Qualtrics integration changes

[Cantor, Scott]

> Just our two-cents to this whole mess. Qualtrics attempted to migrate our
> "brand" (their term for tenant) to one of their new SPs
> (https://ca1.qualtrics.com) this morning. Despite having set their requested
> signing preferences (unsigned responses, signed assertions) in relying-
> party.xml, it seems that Qualtrics is still having issues consuming assertions
> their old SP was perfectly happy to accept.

We haven't flipped the switch yet, but that's certainly a good warning.

> Based on a comment they made earlier about missing an expected ePSA
> value, I suspect they might be trying to (erroneously) assume things about
> the order of multi-valued attributes. I'll update the list when we have more
> information, but they've solidly bungled this. I'll also be pushing back to see if
> they'll change their signing preferences back to the default.

I asked them to report it as a bug but also accomodated them for the time being.

I can also tell you why this has gone sideways: they informed me that they are converting their perfectly functional SimpleSAML.php deployment to a one-off they have built themselves on top of OpenSAML. I naturally told them that was a terrible idea, and all of these problems of course are the reason why.

-- Scott