feat(sso): allow disabling SAML AuthnRequest signing per SSO configuration

[dorsha]

Description

Issue: https://github.com/descope/etc/issues/18144
go-sdk: descope/go-sdk#842 · node-sdk: descope/node-sdk#805

Descope signs the SAML AuthnRequest it sends to a tenant's IdP. A few IdPs (NetIQ Access Manager among them) reject a signed request outright when their trusted-provider entry holds no signing certificate for Descope, and until now there was no way to opt out.

This exposes the new per-SSO-configuration flag:

• disable_sign_request on SSOSAMLSettings and SSOSAMLSettingsByMetadata.

Both parameters are appended last, following the convention already used for idp_entity_id on the metadata class, so positional compatibility for existing callers is preserved. They default to False, so existing callers keep signing exactly as they do today.

The flag is always sent in the composed request body rather than omitted when false: the server takes the settings object as a full replacement, so omitting it on an update would silently turn signing back on. The existing body assertions in test_sso_settings.py are updated accordingly.

Sync and async clients share the body composer, so both are covered.

[shuni-bot]

🐕 Review complete — View session on Shuni Portal 🐾

🤖 Model: claude-sonnet-5

[shuni-bot]

🐕 Suggested Reviewers

Reviewers: 0 (LioriE), 1 (ruvenzx), 3 (chris4490)

Strategy:
The PR spans multiple areas: core SSO logic (_sso_settings_base.py and sso_settings.py), documentation updates, and tests. I've selected reviewers to cover each area: LioriE authored most changes to the core SSO settings files, ruvenzx and chris4490 each touched README.md (for documentation and release notes). This ensures comprehensive review of all changes while avoiding duplication for unchanged modules like tests/management/test_sso_settings.py.)

Reviewer	Reason
LioriE	Primary contributor to core SSO logic. Authored 5 commits across _sso_settings_base.py and sso_settings.py, the main modules modified in this PR. Should review SAML AuthnRequest signing functionality and its new configuration options.
ruvenzx	Contributor to README.md (documentation). The PR expands documentation for the new setting and should be reviewed for accuracy and clarity.
chris4490	Contributor to README.md (documentation). The PR expands documentation for the new setting and should be reviewed for accuracy and clarity.

_{Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best.}

[shuni-bot]

🐕 Shuni Review

Adds an optional disable_sign_request flag to SSOSAMLSettings/SSOSAMLSettingsByMetadata so per-tenant SAML AuthnRequests can be sent unsigned.

Actionable comments posted: 0

Merge risk: 🟢 Low: small, additive change; new param is appended last with a False default preserving positional compatibility, both sync and async clients share the same body composer, and all 5 affected test assertions were updated to match the always-sent disableSignRequest field.

🤖 Model: claude-sonnet-5

---

Review scope: Full review

Reviewed files (4)

• README.md
• descope/management/_sso_settings_base.py
• descope/management/sso_settings.py
• tests/management/test_sso_settings.py

[github-actions]

Coverage report

The coverage rate went from 98.26% to 98.26% ⬆️

100% of new lines are covered.

Diff Coverage details (click to unfold)

descope/management/sso_settings.py

100% of new lines are covered (100% of the complete file).

[shuni-bot]

🐕 Review complete — View session on Shuni Portal 🐾

🤖 Model: claude-sonnet-5

[shuni-bot]

🐕 Shuni Review

No new issues found.

🤖 Model: claude-sonnet-5

---

Review scope: Full review

Reviewed files (4)

• README.md
• descope/management/_sso_settings_base.py
• descope/management/sso_settings.py
• tests/management/test_sso_settings.py