gamlastan 0.2.0

SAML 2.0 library - types, XML, crypto, metadata, bindings, security, profiles
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

//! # gamlastan::bindings
//!
//! SAML 2.0 protocol bindings implementation.
//!
//! This crate implements the SAML 2.0 protocol bindings defined in
//! `saml-bindings-2.0-os`:
//!
//! - **HTTP Redirect** (Section 3.4) - DEFLATE + query string encoding, detached signatures
//! - **HTTP POST** (Section 3.5) - Base64 form encoding, XHTML auto-submit
//! - **HTTP Artifact** (Section 3.6) - Type 0x0004 artifacts, one-time-use enforcement
//! - **SOAP** (Section 3.2) - SOAP 1.1 envelope wrapping/unwrapping
//! - **PAOS** (Section 3.3) - Reverse SOAP for ECP profile
//! - **URI** (Section 3.7) - Simple GET with assertion ID
//!
//! ## Design
//!
//! The bindings are framework-agnostic, using traits (`HttpRequest`,
//! `HttpResponseBuilder`, `SoapTransport`) that can be implemented for
//! any web framework (actix-web, axum, etc.).
//!
//! ## Errata Compliance
//!
//! - **E1**: RelayState covered by redirect signature
//! - **E4**: SAML V1.1 artifacts rejected
//! - **E90**: RelayState XSS/CSRF sanitization
//! - **E91**: ds:Object rejection delegated to gamlastan crypto

pub mod artifact;
pub mod caching;
pub mod deflate;
pub mod encoding;
pub mod error;
pub mod paos;
pub mod post;
pub mod redirect;
pub mod relay_state;
pub mod soap;
pub mod traits;
pub mod uri;

// Re-exports for convenience.
pub use artifact::SamlArtifact;
pub use error::BindingError;
pub use redirect::{redirect_decode, redirect_encode, RedirectDecoded, RedirectEncodeParams};
pub use relay_state::RelayState;
pub use traits::{ArtifactStore, HttpRequest, HttpResponseBuilder, SoapTransport};

use std::borrow::Cow;

/// Decoded SAML message from any binding.
///
/// Uses `Cow` for zero-copy where possible:
/// - SOAP: body can be borrowed directly as `&[u8]`
/// - HTTP POST: base64 decode requires allocation (`Cow::Owned`)
/// - HTTP Redirect: DEFLATE decompression requires allocation (`Cow::Owned`)
/// - HTTP Artifact: artifact string is small, borrowed from query/form param
#[derive(Debug)]
pub struct DecodedMessage<'a> {
    /// The SAML XML message bytes.
    ///
    /// For HTTP POST: base64-decoded bytes (allocated).
    /// For HTTP Redirect: DEFLATE-decompressed bytes (allocated).
    /// For SOAP: slice of request body (zero-copy when possible).
    pub saml_xml: Cow<'a, [u8]>,

    /// RelayState, if present.
    pub relay_state: Option<&'a str>,

    /// Whether this is a SAMLRequest (true) or SAMLResponse (false).
    pub is_request: bool,

    /// Whether the message's signature has been verified.
    /// `None` means no signature was present/checked.
    pub signature_valid: Option<bool>,
}