A write-up of a Synology DS925+ SAML SSO auth bypass, where an empty config quietly turns off signature checks.