Add SP role interfaces, sync with latest SAML 2.0 spec