[3.2-g] Update github.com/russellhaering/goxmldsig to v1.1.0

CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 3.2.16
+
+This release of Teleport contains a security fix.
+
+* Mitigated [CVE-2020-9283](https://groups.google.com/forum/#!msg/golang-announce/3L45YRc91SY/ywEPcKLnGQAJ) by updating golang.org/x/crypto.
+
+## 3.2.15
+
+This release of Teleport contains a bug fix.
+
+* Fixed a regression in role mapping between trusted clusters. [#3252](https://github.com/gravitational/teleport/issues/3252)
+
 ## 3.2.14
 
 This release of Teleport contains a bug fix and a feature.

Makefile

@@ -10,7 +10,7 @@
 # Naming convention:
 #	for stable releases we use "1.0.0" format
 #   for pre-releases, we use   "1.0.0-beta.2" format
-VERSION=3.2.14
+VERSION=3.2.17-gravity
 
 # These are standard autotools variables, don't change them please
 BUILDDIR ?= build

lib/services/saml.go

@@ -540,15 +540,17 @@ func (o *SAMLConnectorV2) GetServiceProvider(clock clockwork.Clock) (*saml2.SAML
 		}
 
 		for _, kd := range metadata.IDPSSODescriptor.KeyDescriptors {
-			certData, err := base64.StdEncoding.DecodeString(kd.KeyInfo.X509Data.X509Certificate.Data)
-			if err != nil {
-				return nil, trace.Wrap(err)
-			}
-			cert, err := x509.ParseCertificate(certData)
-			if err != nil {
-				return nil, trace.Wrap(err, "failed to parse certificate in metadata")
+			for _, samlCert := range kd.KeyInfo.X509Data.X509Certificates {
+				certData, err := base64.StdEncoding.DecodeString(strings.TrimSpace(samlCert.Data))
+				if err != nil {
+					return nil, trace.Wrap(err)
+				}
+				cert, err := x509.ParseCertificate(certData)
+				if err != nil {
+					return nil, trace.Wrap(err, "failed to parse certificate in metadata")
+				}
+				certStore.Roots = append(certStore.Roots, cert)
 			}
-			certStore.Roots = append(certStore.Roots, cert)
 		}
 		o.Spec.Issuer = metadata.EntityID
 		o.Spec.SSO = metadata.IDPSSODescriptor.SingleSignOnService.Location