bugfix: Make sure a persistent NameID is not generated by default when the UserID is missing in the state array.

This allowed misconfigured IdPs (i.e. those without both a PersistenNameID authproc filter, a “userid.attribute” configuration option and no “eduPersonPrincipalName” attribute available after running all the authentication processing filters) to generate a persistent NameID based on “null”, effectively giving all users the same identifier.

bugfix: When obtaining a UserID for the state array prior to running authproc filters, if the source attribute had multiple values a warning was logged but the UserID was still recorded.

- Variables possibly undefined when first used.
- Usage of XMLSecurityKey class without proper namespace.

This resolves #530. There are two problems here:

- When only one SubjectConfirmation is received and it is empty, an error should be thrown. However, the error would be a not very descriptive message warning about access to a non-property in a null object. Something more descriptive should be in place.
- Additionally, in PHP 7.0 this is an error and not an exception, and then the code continues to execute, effectively allowing assertions without a proper SubjectConfirmation element. This is wrong according to the standard.

Add translated error info in data for error template. This is needed in order for theming error page with Twig.

This resolves #523.

This resolves #519.

The $store and $params variables were not initialized before trying to execute the prepared statement.

This resolves #519.

bugfix: When generating a NameID from a multivalued attribute, a warning was logged but the NameID was still generated.

Fix APR1_MD5::check call

$password and $crypted where swapped

Frequently people put fs paths in baseurlpath or URL paths in
the other settings. By more clearly separating these two classes
of options I hope to reduce confusion a bit.

For #458

The guidelines on how to write your own module talk about the process() method receiving a “$request” or a “$state” parameter, instead of being consistent and sticking to just one of the names. Use “$request”.

Deprecate AttributeRealm authproc filter

That should be done in the release branches themselves, and the release number in the spec file updated as part of the release process.