Merge pull request #21 from InVisionApp/update-sig-check

BSH-161 narrow focus of sig check skip

Author: CPWeaver

service_provider.go

@@ -887,10 +887,6 @@ func (sp *ServiceProvider) parseResponse(responseEl *etree.Element, possibleRequ
 	var responseSignatureErr error
 	var responseHasSignature bool
 
-	if sp.SkipResponseSignatureCheck {
-		signatureRequirement = signatureNotRequired
-	}
-
 	if signatureRequirement == signatureRequired {
 		responseSignatureErr = sp.validateSignature(responseEl)
 		if responseSignatureErr != errSignatureElementNotPresent {
@@ -952,7 +948,11 @@ func (sp *ServiceProvider) parseResponse(responseEl *etree.Element, possibleRequ
 			// the request has no signature, so assertions must be signed
 			signatureRequirement = signatureRequired // nop
 		default:
-			return nil, responseSignatureErr
+			if sp.SkipResponseSignatureCheck {
+				signatureRequirement = signatureNotRequired
+			} else {
+				return nil, responseSignatureErr
+			}
 		}
 	}