Enum SamlError 

#[non_exhaustive]
pub enum SamlError {
    Deflate(Error),
    Base64(DecodeError),
    Xml(String),
    Invalid(String),
    ProtocolProfile(String),
    Unsupported(String),
    UnsupportedBinding {
        binding: Binding,
    },
    IssuerMismatch {
        expected: String,
        actual: Option<String>,
    },
    DestinationMismatch {
        expected: String,
        actual: Option<String>,
    },
    InResponseToMismatch {
        expected: Option<String>,
        actual: Option<String>,
    },
    RelayStateMismatch {
        expected: RelayStateParam,
        actual: RelayStateParam,
    },
    AudienceMismatch {
        expected: String,
    },
    StatusNotSuccess {
        top: String,
        second: Option<String>,
    },
    TimeWindowInvalid {
        field: TimeWindowField,
    },
    SubjectConfirmationInvalid {
        reason: SubjectConfirmationReason,
    },
    ReplayDetected {
        key: String,
    },
    SignatureMissing,
    MissingBindingParameter {
        name: &'static str,
    },
    SignatureVerification {
        reason: SignatureVerificationReason,
    },
    ReferenceResolution {
        reason: ReferenceResolutionReason,
    },
    SignedReferenceMismatch,
    AssertionSignatureRequired,
    NoTrustedCertificate,
    CertificateMismatch,
    UnmatchIssuer,
    UnmatchAudience,
    UnmatchDestination,
    InvalidInResponseTo,
    UndefinedStatus,
    FailedStatus {
        top: String,
        second: String,
    },
    ExpiredSession,
    SubjectUnconfirmed,
    PotentialWrappingAttack,
    MissingSigAlg,
    FailedMessageSignatureVerification,
    FailedToVerifySignature,
    UnmatchCertificate,
    UndefinedBinding,
    MissingMetadata(String),
    MissingKey(String),
    Crypto(String),
}

Errors produced by the SAML-RS library.

Variants are grouped by validation category:

• wire and XML decoding failures;
• SAML protocol validation failures;
• signature, signed-reference, and delegated crypto failures;
• metadata and trust selection failures;
• configuration, unsupported binding, and compatibility failures.

This enum is #[non_exhaustive]; downstream callers should include a fallback arm when matching.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Deflate(Error)

Raw DEFLATE (de)compression failed.

Base64(DecodeError)

Base64 decoding failed.

Xml(String)

Malformed or unexpected XML.

Invalid(String)

Input failed validation.

ProtocolProfile(String)

Inbound XML does not satisfy the SAML 2.0 protocol QName or version profile.

Unsupported(String)

Functionality not yet implemented in the current milestone.

UnsupportedBinding

Requested binding is not supported by this API path.

Fields

binding: Binding

Binding that reached an unsupported profile path.

IssuerMismatch

Issuer in the message does not match the expected peer entity ID.

Fields

expected: String

Expected peer entity ID.

actual: Option<String>

Actual issuer value extracted from the message, when available.

DestinationMismatch

Response Destination does not match the expected recipient URL.

Fields

expected: String

Expected recipient URL.

actual: Option<String>

Actual destination value extracted from the message, when available.

InResponseToMismatch

InResponseTo does not match the expected request ID.

Fields

expected: Option<String>

Expected request ID. None means no request correlation was expected.

actual: Option<String>

Actual InResponseTo value extracted from the message, when available.

RelayStateMismatch

RelayState does not match the pending message correlation state.

Fields

expected: RelayStateParam

Expected RelayState presence and value.

actual: RelayStateParam

Actual RelayState presence and value.

AudienceMismatch

<Audience> does not include the expected Service Provider entity ID.

Fields

expected: String

Expected SP entity ID.

StatusNotSuccess

Response carried a non-success SAML status code.

Fields

top: String

Top-tier status code.

second: Option<String>

Optional second-tier status code.

TimeWindowInvalid

Assertion or session time bounds are not satisfied.

Fields

field: TimeWindowField

SAML field or validation scope whose time window failed.

SubjectConfirmationInvalid

Bearer subject confirmation requirements are not satisfied.

Fields

reason: SubjectConfirmationReason

Stable validation reason for callers and logs.

ReplayDetected

A duplicate SAML message or assertion key was detected.

Fields

key: String

Replay cache key or duplicate identifier.

SignatureMissing

Required signature is absent.

MissingBindingParameter

Required binding parameter is absent.

Fields

name: &'static str

Binding parameter name.

SignatureVerification

Signature verification failed for a semantic SAML validation reason.

Fields

reason: SignatureVerificationReason

Stable verification reason for callers and logs.

ReferenceResolution

Signed reference could not be resolved safely.

Fields

reason: ReferenceResolutionReason

Stable reference-resolution reason for callers and logs.

SignedReferenceMismatch

Verified signed reference does not cover the consumed payload.

AssertionSignatureRequired

Assertion-signature policy requires direct coverage of the consumed assertion.

NoTrustedCertificate

No trusted certificate could be selected for verification.

CertificateMismatch

Certificate embedded in the message does not match configured metadata.

UnmatchIssuer

Compatibility variant for issuer validation; prefer Self::IssuerMismatch.

UnmatchAudience

Compatibility variant for audience validation; prefer Self::AudienceMismatch.

UnmatchDestination

Compatibility variant for destination validation; prefer Self::DestinationMismatch.

InvalidInResponseTo

Caller supplied a malformed request ID for response correlation.

Prefer Self::InResponseToMismatch when a message value fails request correlation.

UndefinedStatus

Response status code is missing, empty, or could not be extracted.

FailedStatus

Compatibility variant for non-success status; prefer Self::StatusNotSuccess.

Fields

top: String

Top-tier status code.

second: String

Second-tier status code (empty when absent).

ExpiredSession

Compatibility variant for elapsed session bounds; prefer Self::TimeWindowInvalid.

SubjectUnconfirmed

Compatibility variant for subject confirmation failures; prefer Self::SubjectConfirmationInvalid.

PotentialWrappingAttack

A signature-wrapping (XSW) attempt was detected.

MissingSigAlg

Compatibility variant for missing binding signature parameters; prefer Self::SignatureMissing or Self::MissingBindingParameter.

FailedMessageSignatureVerification

Compatibility variant for detached signature failures; prefer Self::SignatureVerification.

FailedToVerifySignature

Compatibility variant for XML-DSig failures; prefer Self::SignatureVerification.

UnmatchCertificate

Compatibility variant for certificate mismatch; prefer Self::CertificateMismatch.

UndefinedBinding

Compatibility variant for unsupported bindings; prefer Self::UnsupportedBinding.

MissingMetadata(String)

Required metadata (endpoint/certificate) was missing.

MissingKey(String)

A required cryptographic key was missing.

Crypto(String)

A delegated cryptographic operation failed.

Trait Implementations

impl Debug for SamlError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for SamlError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for SamlError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<DecodeError> for SamlError

fn from(source: DecodeError) -> Self

Converts to this type from the input type.

impl From<Error> for SamlError

fn from(source: Error) -> Self

Converts to this type from the input type.