Api to extract response ids?

[jborg]

What is the recommended method to detect and stop replay attacts in the IdP initiated scenario?

My initial idea was to persist all previously seen Response and Assertion ids ignore responses that contain preciously seen Response or Assertion ids. Unfortunately I've not been able to find any good way to extract these ids from the response. They seem to be added to a local variable called "verified_ids" but there is no way to access it.

[pitbulk]

You can persist the ids a short period of time (as far as the SAMLResponse is not consider expired).

I will review and merge your PR today and plan to do a new release too.