in checking responses, the underlying library skips the checks for certain attributes if they are not present

[simevo]

... for example for the Destination element in Response:
https://github.com/onelogin/php-saml/blob/master/lib/Saml2/Response.php#L227
but the SPID spec it is required (page 11/12) :

nell’ elemento <Response> ... deve essere presente l’attributo Destination

One approach to fix this without patching upstream code is to turn on the security.wantXMLValidation option and patch the schemas

NOTE: the SAML XSDs are not sufficient, for the example above Destination element in Response is optional for the SAML XSD

[simevo]

another solution is to unpack the XML with simple_xml on our side and do the checks that php-saml skips