Struct SsoSession

Source

pub struct SsoSession { /* private fields */ }

Expand description

Parsed SSO login session.

Implementations§

Source §

impl SsoSession

Source

pub fn response_id(&self) -> &MessageId

Response ID.

Source

pub fn assertion_id(&self) -> &AssertionId

Assertion ID.

Source

pub fn issuer(&self) -> &EntityId

Assertion issuer.

Source

pub fn in_response_to(&self) -> Option<&MessageId>

InResponseTo, when present.

Source

pub fn subject(&self) -> &Subject

Subject.

Source

pub fn name_id(&self) -> &NameId

Subject NameID.

Examples found in repository ?

examples/sso.rs (line 84)

8fn main() -> Result<(), Box<dyn std::error::Error>> {
9    use saml_rs::{
10        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
11        IdpDescriptor, IdpValidationPolicy, MetadataTrustPolicy, NameId, PrivateKeyPem,
12        RelayStateParam, ReplayPolicy, RespondSso, Saml, SamlValidationContext, SpConfig,
13        SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse, StartSso, Subject,
14    };
15    use std::time::SystemTime;
16
17    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
18    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
19    let credentials = || Credentials {
20        signing_key: Some(PrivateKeyPem::new(privkey)),
21        signing_certificate: Some(CertificatePem::new(cert)),
22        ..Credentials::default()
23    };
24    let validation =
25        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);
26
27    let sp = Saml::sp(
28        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
29            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
30            .credentials(credentials())
31            .validation(SpValidationPolicy::strict())
32            .build()?,
33    )?;
34    let idp = Saml::idp(
35        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
36            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
37            .credentials(credentials())
38            .validation(IdpValidationPolicy::strict())
39            .build()?,
40    )?;
41
42    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
43        EntityId::try_new("https://sp.example.com/metadata")?,
44        sp.metadata_xml(),
45        MetadataTrustPolicy::UnsignedForCompatibility,
46    )?;
47    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
48        EntityId::try_new("https://idp.example.com/metadata")?,
49        idp.metadata_xml(),
50        MetadataTrustPolicy::UnsignedForCompatibility,
51    )?;
52
53    let relay_state = RelayStateParam::try_from_option(Some("demo-state".to_string()))?;
54    let started = sp.start_sso(&idp_descriptor, StartSso::post().relay_state(relay_state))?;
55    println!(
56        "SP  -> AuthnRequest id = {}",
57        started.pending.request_id().as_str()
58    );
59
60    let request = idp.receive_sso(
61        &sp_descriptor,
62        BrowserInput::<AuthnRequest>::post(started.outbound.post_form()?.fields().to_vec()),
63        validation(),
64    )?;
65    println!(
66        "IdP <- request issuer  = {}",
67        request.message().issuer().as_str()
68    );
69
70    let response = idp.respond_sso(
71        &sp_descriptor,
72        &request,
73        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
74        RespondSso::post(),
75    )?;
76
77    let session = sp.finish_sso(
78        &idp_descriptor,
79        &started.pending,
80        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
81        validation(),
82    );
83    let session = session?;
84    println!("SP  <- authenticated   = {}", session.name_id().value());
85    Ok(())
86}

Source

pub fn attributes(&self) -> &Attributes

Attributes.

Source

pub fn authn_session(&self) -> &AuthnSession

Legacy singular view of AuthnStatement session data.

This compatibility accessor returns the first statement in document order. For assertions containing multiple statements, use Self::authn_sessions. When no statement is present, it returns an immutable empty AuthnSession.

Source

pub fn authn_sessions(&self) -> &[AuthnSession]

Every AuthnStatement session tuple in XML document order.

Source

pub fn audience(&self) -> &[EntityId]

Audience restrictions.

Source

pub fn not_before(&self) -> Option<&SamlInstant>

Conditions NotBefore.

Source

pub fn not_on_or_after(&self) -> Option<&SamlInstant>

Conditions NotOnOrAfter.

Source

pub fn sig_alg(&self) -> Option<&str>

Verified detached signature algorithm, when applicable.

Source

pub fn assertion(&self) -> Assertion

Assertion view.

Source

pub fn logout_subject(&self) -> Option<LogoutSubject>

Subject data suitable for issuing Single Logout.

Every present SessionIndex is included in AuthnStatement document order.

§Examples

use saml_rs::{IdpDescriptor, Saml, SamlError, SsoSession, StartSlo};

let subject = session
    .logout_subject()
    .ok_or_else(|| SamlError::Invalid("missing logout subject".into()))?;
let started = sp.start_slo(idp, subject, StartSlo::redirect())?;

let redirect_url = started.outbound.redirect_url()?;

Examples found in repository ?

examples/slo.rs (line 74)

7fn main() -> Result<(), Box<dyn std::error::Error>> {
8    use saml_rs::{
9        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
10        IdpDescriptor, IdpValidationPolicy, LogoutRequest, LogoutResponse, MetadataTrustPolicy,
11        NameId, PrivateKeyPem, ReplayPolicy, RespondSlo, RespondSso, Saml, SamlValidationContext,
12        SloEndpoint, SpConfig, SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse,
13        StartSlo, StartSso, Subject,
14    };
15    use std::time::SystemTime;
16
17    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
18    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
19    let credentials = || Credentials {
20        signing_key: Some(PrivateKeyPem::new(privkey)),
21        signing_certificate: Some(CertificatePem::new(cert)),
22        ..Credentials::default()
23    };
24    let validation =
25        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);
26
27    let sp = Saml::sp(
28        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
29            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
30            .slo_endpoint(SloEndpoint::post("https://sp.example.com/slo")?)
31            .credentials(credentials())
32            .validation(SpValidationPolicy::strict())
33            .build()?,
34    )?;
35    let idp = Saml::idp(
36        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
37            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
38            .slo_endpoint(SloEndpoint::post("https://idp.example.com/slo")?)
39            .credentials(credentials())
40            .validation(IdpValidationPolicy::strict())
41            .build()?,
42    )?;
43    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
44        EntityId::try_new("https://sp.example.com/metadata")?,
45        sp.metadata_xml(),
46        MetadataTrustPolicy::UnsignedForCompatibility,
47    )?;
48    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
49        EntityId::try_new("https://idp.example.com/metadata")?,
50        idp.metadata_xml(),
51        MetadataTrustPolicy::UnsignedForCompatibility,
52    )?;
53
54    let sso = sp.start_sso(&idp_descriptor, StartSso::post())?;
55    let request = idp.receive_sso(
56        &sp_descriptor,
57        BrowserInput::<AuthnRequest>::post(sso.outbound.post_form()?.fields().to_vec()),
58        validation(),
59    )?;
60    let response = idp.respond_sso(
61        &sp_descriptor,
62        &request,
63        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
64        RespondSso::post(),
65    )?;
66    let session = sp.finish_sso(
67        &idp_descriptor,
68        &sso.pending,
69        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
70        validation(),
71    )?;
72
73    let subject = session
74        .logout_subject()
75        .ok_or("session has no logout subject")?;
76    let logout = sp.start_slo(&idp_descriptor, subject, StartSlo::post())?;
77    println!("SP  -> LogoutRequest id = {}", logout.pending.id().as_str());
78
79    let logout_request = idp.receive_slo(
80        &sp_descriptor,
81        BrowserInput::<LogoutRequest>::post(logout.outbound.post_form()?.fields().to_vec()),
82        validation(),
83    )?;
84    let logout_response = idp.respond_slo(
85        &sp_descriptor,
86        &logout_request,
87        RespondSlo::post().relay_state(logout.pending.relay_state().clone()),
88    )?;
89    let completed = sp.finish_slo(
90        &idp_descriptor,
91        &logout.pending,
92        BrowserInput::<LogoutResponse>::post(logout_response.post_form()?.fields().to_vec()),
93        validation(),
94    )?;
95    println!(
96        "SP  <- LogoutResponse status = {}",
97        completed.status().unwrap_or("missing")
98    );
99    Ok(())
100}

Source

pub fn replay_keys(&self) -> Vec<ReplayKey>

Replay keys available from this validated SSO session.

Source

pub fn check_and_store_replay( &self, validation: &mut SamlValidationContext<'_>, ) -> Result<(), SamlError>

Check and store this session’s replay keys using the caller cache.

This method is intended for typed inbound SSO facades. It should be called only after signature, issuer, audience, destination, recipient, InResponseTo, and time validation have already passed.

§Errors

Returns SamlError::TimeWindowInvalid when no valid replay expiration can be derived or the session is already expired. Replay expiration uses the earliest upper bound across Conditions, bearer SubjectConfirmation data, and every AuthnStatement. Returns SamlError::ReplayDetected when any session replay key has already been seen. Cache implementations may also return storage-specific failures mapped to SamlError.

Source