gamlastan 0.4.1

SAML 2.0 library - types, XML, crypto, metadata, bindings, security, profiles
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146

// SAML 2.0 Profile errors

use thiserror::Error;

/// Errors that can occur during SAML profile operations.
#[derive(Debug, Error)]
pub enum ProfileError {
    // --- SSO Profile errors ---
    #[error("missing Issuer element in AuthnRequest")]
    MissingIssuer,

    #[error("Issuer format must be entity or omitted, got: {0}")]
    InvalidIssuerFormat(String),

    #[error("AuthnRequest Subject must not contain SubjectConfirmation")]
    SubjectConfirmationInAuthnRequest,

    #[error("no SSO endpoint found for IdP with binding: {0}")]
    NoSsoEndpoint(String),

    #[error("no ACS endpoint found for SP with binding: {0}")]
    NoAcsEndpoint(String),

    #[error("ACS URL in AuthnRequest does not match any SP endpoint")]
    AcsUrlMismatch,

    #[error("response status indicates failure: {0}")]
    ResponseFailure(String),

    #[error("no assertions found in response")]
    NoAssertions,

    #[error("no AuthnStatement found in assertion")]
    NoAuthnStatement,

    #[error("assertion validation failed: {0}")]
    AssertionValidation(String),

    // --- Logout Profile errors ---
    #[error("missing NameID in LogoutRequest")]
    MissingNameId,

    #[error("missing SessionIndex in LogoutRequest")]
    MissingSessionIndex,

    #[error("session not found for NameID")]
    SessionNotFound,

    #[error("partial logout: {success} of {total} participants logged out")]
    PartialLogout { success: usize, total: usize },

    // --- Artifact Resolution errors ---
    #[error("artifact resolution failed: {0}")]
    ArtifactResolutionFailed(String),

    #[error("artifact response status indicates failure: {0}")]
    ArtifactResponseFailure(String),

    // --- Name ID Management errors ---
    #[error("name ID management failed: {0}")]
    NameIdManagementFailed(String),

    // --- Name ID Mapping errors ---
    #[error("name ID mapping failed: {0}")]
    NameIdMappingFailed(String),

    #[error("name ID mapping response missing NameID")]
    MappingResponseMissingNameId,

    // --- ECP errors ---
    #[error("AssertionConsumerServiceURL does not match PAOS responseConsumerURL")]
    EcpAcsUrlMismatch,

    #[error("missing PAOS header in ECP request")]
    MissingPaosHeader,

    #[error("missing ecp:Request header in phase-1 ECP envelope")]
    EcpMissingRequestHeader,

    #[error("missing ecp:Response header in IdP response")]
    EcpMissingResponseHeader,

    // --- Subject Confirmation errors ---
    #[error("subject confirmation method not supported: {0}")]
    UnsupportedConfirmationMethod(String),

    #[error("bearer confirmation missing SubjectConfirmationData")]
    BearerMissingConfirmationData,

    #[error("bearer confirmation missing Recipient")]
    BearerMissingRecipient,

    #[error("bearer confirmation Recipient mismatch: expected {expected}, got {actual}")]
    BearerRecipientMismatch { expected: String, actual: String },

    #[error("bearer confirmation expired (NotOnOrAfter)")]
    BearerExpired,

    #[error("bearer confirmation has InResponseTo mismatch")]
    BearerInResponseToMismatch,

    // --- Attribute Profile errors ---
    #[error("attribute missing required xsi:type for basic profile")]
    BasicProfileMissingType,

    #[error("invalid attribute name format: expected {expected}, got {actual}")]
    InvalidAttributeNameFormat { expected: String, actual: String },

    // --- IdP Discovery errors ---
    #[error("invalid Common Domain Cookie value")]
    InvalidCommonDomainCookie,

    #[error("discovery service request missing entityID parameter")]
    DiscoveryMissingEntityId,

    #[error("discovery service return URL is not registered in SP metadata: {0}")]
    DiscoveryReturnUrlNotRegistered(String),

    #[error("no discovery return URL: none in request and no DiscoveryResponse in metadata")]
    DiscoveryNoReturnUrl,

    // --- General errors ---
    #[error("metadata error: {0}")]
    Metadata(String),

    #[error("binding error: {0}")]
    Binding(#[from] crate::bindings::BindingError),

    #[error("core error: {0}")]
    Core(#[from] crate::core::error::CoreError),

    #[error("security error: {0}")]
    Security(#[from] crate::security::SecurityError),

    #[error("unsolicited SSO response not allowed by configuration")]
    UnsolicitedNotAllowed,

    #[error("crypto error: {0}")]
    Crypto(#[from] crate::crypto::error::CryptoError),

    #[error("XML error: {0}")]
    Xml(#[from] crate::xml::error::XmlError),

    #[error("{0}")]
    Other(String),
}