entropy-auth 2026.7.31

Authentication and authorization for Entropy Softworks server and API projects
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

//! SAML 2.0 assertion parsing and SP metadata generation.
//!
//! # Security — this module does NOT verify XML signatures
//!
//! **This module performs no XML digital-signature verification** (it has no
//! XML-DSig / RSA / X.509 support). It parses a SAML Response and validates
//! its *conditions* — structure, status, destination, issuer, audience,
//! subject-confirmation recipient, and temporal windows — but it cannot
//! establish that the assertion actually came from the `IdP`. Every field is
//! attacker-controlled until a signature is verified.
//!
//! To make that unmissable at every call site, the entry points are named
//! accordingly: you parse with [`SamlResponse::parse_base64_unverified`] /
//! [`SamlResponse::parse_xml_unverified`], and the condition checks live in
//! [`SamlResponse::validate_conditions_only`]. None of these is a trust
//! decision on its own.
//!
//! A consumer that federates via SAML MUST, in addition to calling
//! `validate_conditions_only`:
//!
//! 1. **Verify the `IdP` XML signature** over the consumed assertion before
//!    trusting any field (e.g. via an external XML-DSig layer / reverse
//!    proxy). Without this, assertions are forgeable.
//! 2. **Enforce replay protection** — this crate is storage-free, so keep a
//!    replay cache keyed on the assertion ID (TTL ≥ the validity window).
//! 3. **Match `InResponseTo`** (via [`SamlSubject::in_response_to`]) against
//!    the outstanding `AuthnRequest` it issued for SP-initiated SSO.
//!
//! Full XML-DSig support is planned for a future release. Until then, do not
//! treat a successful `validate_conditions_only` as an authentication.

mod assertion;
mod config;
#[cfg(feature = "asym-jwt")]
mod idp;
mod metadata;
mod response;

/// SAML assertion namespace URI.
///
/// Shared across `assertion` and `response` sub-modules to avoid
/// duplicating the constant.
pub(crate) const SAML_NS: &str = "urn:oasis:names:tc:SAML:2.0:assertion";

pub use self::assertion::{SamlAssertion, SamlAttribute, SamlConditions, SamlSubject};
pub use self::config::{SamlConfig, SamlConfigError};
#[cfg(feature = "asym-jwt")]
pub use self::idp::{
    AssertionParams, AuthnRequest, ResponseParams, SamlIdpError, build_signed_response,
    generate_idp_metadata, parse_authn_request, verify_signed_response,
};
pub use self::metadata::generate_sp_metadata;
pub use self::response::{SamlResponse, SamlResponseError, SamlStatus};