saml-rs 0.3.0

Pure-Rust SAML 2.0 Service Provider and Identity Provider support.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123

//! SAML message field-sets for XML extraction.

use super::extract::ExtractorField;

/// Fields for an `<AuthnRequest>` (`loginRequestFields`).
pub fn login_request_fields() -> Vec<ExtractorField> {
    vec![
        ExtractorField::new("request", &["AuthnRequest"]).attrs(&[
            "ID",
            "IssueInstant",
            "Destination",
            "AssertionConsumerServiceURL",
            "ProtocolBinding",
            "AssertionConsumerServiceIndex",
        ]),
        ExtractorField::new("issuer", &["AuthnRequest", "Issuer"]),
        ExtractorField::new("nameIDPolicy", &["AuthnRequest", "NameIDPolicy"])
            .attrs(&["Format", "AllowCreate"]),
        ExtractorField::new(
            "authnContextClassRef",
            &["AuthnRequest", "AuthnContextClassRef"],
        ),
        ExtractorField::new("signature", &["AuthnRequest", "Signature"]).with_context(),
    ]
}

/// Two-tier status fields for a `<Response>` (`loginResponseStatusFields`).
pub fn login_response_status_fields() -> Vec<ExtractorField> {
    vec![
        ExtractorField::new("top", &["Response", "Status", "StatusCode"]).attrs(&["Value"]),
        ExtractorField::new(
            "second",
            &["Response", "Status", "StatusCode", "StatusCode"],
        )
        .attrs(&["Value"]),
    ]
}

/// Two-tier status fields for a `<LogoutResponse>` (`logoutResponseStatusFields`).
pub fn logout_response_status_fields() -> Vec<ExtractorField> {
    vec![
        ExtractorField::new("top", &["LogoutResponse", "Status", "StatusCode"]).attrs(&["Value"]),
        ExtractorField::new(
            "second",
            &["LogoutResponse", "Status", "StatusCode", "StatusCode"],
        )
        .attrs(&["Value"]),
    ]
}

/// Fields for a login `<Response>` (`loginResponseFields`).
///
/// `assertion` is the (verified) assertion XML used as the `shortcut` document
/// for assertion-scoped fields; `response` is read from the full message.
pub fn login_response_fields(assertion: &str) -> Vec<ExtractorField> {
    vec![
        ExtractorField::new("assertion", &["Assertion"])
            .attrs(&["ID", "IssueInstant"])
            .with_shortcut(assertion),
        ExtractorField::new("conditions", &["Assertion", "Conditions"])
            .attrs(&["NotBefore", "NotOnOrAfter"])
            .with_shortcut(assertion),
        ExtractorField::new("response", &["Response"]).attrs(&[
            "ID",
            "IssueInstant",
            "Destination",
            "InResponseTo",
        ]),
        ExtractorField::new(
            "audience",
            &["Assertion", "Conditions", "AudienceRestriction", "Audience"],
        )
        .with_shortcut(assertion),
        ExtractorField::new("issuer", &["Assertion", "Issuer"]).with_shortcut(assertion),
        ExtractorField::new("nameID", &["Assertion", "Subject", "NameID"]).with_shortcut(assertion),
        ExtractorField::new("nameIDFormat", &["Assertion", "Subject", "NameID"])
            .attrs(&["Format"])
            .with_shortcut(assertion),
        ExtractorField::new(
            "subjectConfirmation",
            &["Assertion", "Subject", "SubjectConfirmation"],
        )
        .with_context()
        .with_shortcut(assertion),
        ExtractorField::new("sessionIndex", &["Assertion", "AuthnStatement"])
            .attrs(&["AuthnInstant", "SessionNotOnOrAfter", "SessionIndex"])
            .with_shortcut(assertion),
        ExtractorField::new(
            "attributes",
            &["Assertion", "AttributeStatement", "Attribute"],
        )
        .aggregate(&["Name"], &["AttributeValue"])
        .with_shortcut(assertion),
    ]
}

/// Fields for a `<LogoutRequest>` (`logoutRequestFields`).
pub fn logout_request_fields() -> Vec<ExtractorField> {
    vec![
        ExtractorField::new("request", &["LogoutRequest"]).attrs(&[
            "ID",
            "IssueInstant",
            "Destination",
        ]),
        ExtractorField::new("issuer", &["LogoutRequest", "Issuer"]),
        ExtractorField::new("nameID", &["LogoutRequest", "NameID"]),
        ExtractorField::new("sessionIndex", &["LogoutRequest", "SessionIndex"]),
        ExtractorField::new("signature", &["LogoutRequest", "Signature"]).with_context(),
    ]
}

/// Fields for a `<LogoutResponse>` (`logoutResponseFields`).
pub fn logout_response_fields() -> Vec<ExtractorField> {
    vec![
        ExtractorField::new("response", &["LogoutResponse"]).attrs(&[
            "ID",
            "Destination",
            "InResponseTo",
        ]),
        ExtractorField::new("issuer", &["LogoutResponse", "Issuer"]),
        ExtractorField::new("signature", &["LogoutResponse", "Signature"]).with_context(),
    ]
}