Struct Saml 

pub struct Saml<Role = Unknown>(/* private fields */);

Typed SAML facade for high-level browser SSO/SLO flows.

Implementations

impl Saml<Idp>

pub fn metadata_xml(&self) -> &str

Local IdP metadata XML.

Examples found in repository

examples/sso.rs (line 49)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, MetadataTrustPolicy, NameId, PrivateKeyPem,
        RelayStateParam, ReplayPolicy, RespondSso, Saml, SamlValidationContext, SpConfig,
        SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;

    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let relay_state = RelayStateParam::try_from_option(Some("demo-state".to_string()))?;
    let started = sp.start_sso(&idp_descriptor, StartSso::post().relay_state(relay_state))?;
    println!(
        "SP  -> AuthnRequest id = {}",
        started.pending.request_id().as_str()
    );

    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(started.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "IdP <- request issuer  = {}",
        request.message().issuer().as_str()
    );

    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;

    let session = sp.finish_sso(
        &idp_descriptor,
        &started.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    );
    let session = session?;
    println!("SP  <- authenticated   = {}", session.name_id().value());
    Ok(())
}

examples/slo.rs (line 50)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, LogoutRequest, LogoutResponse, MetadataTrustPolicy,
        NameId, PrivateKeyPem, ReplayPolicy, RespondSlo, RespondSso, Saml, SamlValidationContext,
        SloEndpoint, SpConfig, SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse,
        StartSlo, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .slo_endpoint(SloEndpoint::post("https://sp.example.com/slo")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .slo_endpoint(SloEndpoint::post("https://idp.example.com/slo")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;
    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let sso = sp.start_sso(&idp_descriptor, StartSso::post())?;
    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(sso.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;
    let session = sp.finish_sso(
        &idp_descriptor,
        &sso.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    )?;

    let subject = session
        .logout_subject()
        .ok_or("session has no logout subject")?;
    let logout = sp.start_slo(&idp_descriptor, subject, StartSlo::post())?;
    println!("SP  -> LogoutRequest id = {}", logout.pending.id().as_str());

    let logout_request = idp.receive_slo(
        &sp_descriptor,
        BrowserInput::<LogoutRequest>::post(logout.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let logout_response = idp.respond_slo(
        &sp_descriptor,
        &logout_request,
        RespondSlo::post().relay_state(logout.pending.relay_state().clone()),
    )?;
    let completed = sp.finish_slo(
        &idp_descriptor,
        &logout.pending,
        BrowserInput::<LogoutResponse>::post(logout_response.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "SP  <- LogoutResponse status = {}",
        completed.status().unwrap_or("missing")
    );
    Ok(())
}

pub fn raw_identity_provider(&self) -> &IdentityProvider

Raw compatibility Identity Provider.

pub fn receive_sso( &self, sp: &SpDescriptor, input: BrowserInput<AuthnRequest>, validation: SamlValidationContext<'_>, ) -> Result<Received<AuthnRequest>, SamlError>

Receive an SP AuthnRequest.

Errors

Returns SamlError when browser input or relay state is invalid, the request binding is unsupported, SP metadata cannot be parsed, XML parsing or signature/trust validation fails, the request destination does not match local metadata, or replay validation detects a duplicate or expired request.

Examples

use saml_rs::{
    AuthnRequest, BrowserInput, FormField, ReplayPolicy, RespondSso, Saml,
    SamlValidationContext, SpDescriptor, Subject,
};
use std::time::SystemTime;

let validation = SamlValidationContext::new(
    SystemTime::now(),
    ReplayPolicy::DisabledForCompatibility,
);
let input = BrowserInput::<AuthnRequest>::post(fields);
let request = idp.receive_sso(sp, input, validation)?;
let response = idp.respond_sso(sp, &request, subject, RespondSso::post())?;

let form = response.post_form()?;

Examples found in repository

examples/sso.rs (lines 60-64)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, MetadataTrustPolicy, NameId, PrivateKeyPem,
        RelayStateParam, ReplayPolicy, RespondSso, Saml, SamlValidationContext, SpConfig,
        SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;

    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let relay_state = RelayStateParam::try_from_option(Some("demo-state".to_string()))?;
    let started = sp.start_sso(&idp_descriptor, StartSso::post().relay_state(relay_state))?;
    println!(
        "SP  -> AuthnRequest id = {}",
        started.pending.request_id().as_str()
    );

    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(started.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "IdP <- request issuer  = {}",
        request.message().issuer().as_str()
    );

    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;

    let session = sp.finish_sso(
        &idp_descriptor,
        &started.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    );
    let session = session?;
    println!("SP  <- authenticated   = {}", session.name_id().value());
    Ok(())
}

examples/slo.rs (lines 55-59)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, LogoutRequest, LogoutResponse, MetadataTrustPolicy,
        NameId, PrivateKeyPem, ReplayPolicy, RespondSlo, RespondSso, Saml, SamlValidationContext,
        SloEndpoint, SpConfig, SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse,
        StartSlo, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .slo_endpoint(SloEndpoint::post("https://sp.example.com/slo")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .slo_endpoint(SloEndpoint::post("https://idp.example.com/slo")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;
    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let sso = sp.start_sso(&idp_descriptor, StartSso::post())?;
    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(sso.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;
    let session = sp.finish_sso(
        &idp_descriptor,
        &sso.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    )?;

    let subject = session
        .logout_subject()
        .ok_or("session has no logout subject")?;
    let logout = sp.start_slo(&idp_descriptor, subject, StartSlo::post())?;
    println!("SP  -> LogoutRequest id = {}", logout.pending.id().as_str());

    let logout_request = idp.receive_slo(
        &sp_descriptor,
        BrowserInput::<LogoutRequest>::post(logout.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let logout_response = idp.respond_slo(
        &sp_descriptor,
        &logout_request,
        RespondSlo::post().relay_state(logout.pending.relay_state().clone()),
    )?;
    let completed = sp.finish_slo(
        &idp_descriptor,
        &logout.pending,
        BrowserInput::<LogoutResponse>::post(logout_response.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "SP  <- LogoutResponse status = {}",
        completed.status().unwrap_or("missing")
    );
    Ok(())
}

pub fn respond_sso( &self, sp: &SpDescriptor, request: &Received<AuthnRequest>, subject: Subject, options: RespondSso, ) -> Result<Outbound<SsoResponse>, SamlError>

Respond to a received SP AuthnRequest.

Errors

Returns SamlError when the request issuer does not match the SP descriptor, relay state is invalid, the request ACS selection conflicts with the response binding or SP metadata, required metadata or signing keys are missing, or response creation fails.

Examples found in repository

examples/sso.rs (lines 70-75)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, MetadataTrustPolicy, NameId, PrivateKeyPem,
        RelayStateParam, ReplayPolicy, RespondSso, Saml, SamlValidationContext, SpConfig,
        SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;

    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let relay_state = RelayStateParam::try_from_option(Some("demo-state".to_string()))?;
    let started = sp.start_sso(&idp_descriptor, StartSso::post().relay_state(relay_state))?;
    println!(
        "SP  -> AuthnRequest id = {}",
        started.pending.request_id().as_str()
    );

    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(started.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "IdP <- request issuer  = {}",
        request.message().issuer().as_str()
    );

    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;

    let session = sp.finish_sso(
        &idp_descriptor,
        &started.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    );
    let session = session?;
    println!("SP  <- authenticated   = {}", session.name_id().value());
    Ok(())
}

examples/slo.rs (lines 60-65)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, LogoutRequest, LogoutResponse, MetadataTrustPolicy,
        NameId, PrivateKeyPem, ReplayPolicy, RespondSlo, RespondSso, Saml, SamlValidationContext,
        SloEndpoint, SpConfig, SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse,
        StartSlo, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .slo_endpoint(SloEndpoint::post("https://sp.example.com/slo")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .slo_endpoint(SloEndpoint::post("https://idp.example.com/slo")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;
    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let sso = sp.start_sso(&idp_descriptor, StartSso::post())?;
    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(sso.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;
    let session = sp.finish_sso(
        &idp_descriptor,
        &sso.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    )?;

    let subject = session
        .logout_subject()
        .ok_or("session has no logout subject")?;
    let logout = sp.start_slo(&idp_descriptor, subject, StartSlo::post())?;
    println!("SP  -> LogoutRequest id = {}", logout.pending.id().as_str());

    let logout_request = idp.receive_slo(
        &sp_descriptor,
        BrowserInput::<LogoutRequest>::post(logout.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let logout_response = idp.respond_slo(
        &sp_descriptor,
        &logout_request,
        RespondSlo::post().relay_state(logout.pending.relay_state().clone()),
    )?;
    let completed = sp.finish_slo(
        &idp_descriptor,
        &logout.pending,
        BrowserInput::<LogoutResponse>::post(logout_response.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "SP  <- LogoutResponse status = {}",
        completed.status().unwrap_or("missing")
    );
    Ok(())
}

pub fn initiate_sso( &self, sp: &SpDescriptor, subject: Subject, options: RespondSso, ) -> Result<Outbound<SsoResponse>, SamlError>

Initiate IdP-initiated SSO.

Errors

Returns SamlError when relay state is invalid, SP metadata cannot be parsed, a compatible ACS endpoint or signing key is missing, the selected binding is unsupported, or response creation fails.

Examples

use saml_rs::{
    BrowserInput, FormField, IdpDescriptor, ReplayPolicy, RespondSso, Saml,
    SamlValidationContext, SpDescriptor, SsoResponse, Subject,
};
use std::time::SystemTime;

let response = idp.initiate_sso(sp_descriptor, subject, RespondSso::post())?;
let form = response.post_form()?;

let validation = SamlValidationContext::new(
    SystemTime::now(),
    ReplayPolicy::DisabledForCompatibility,
);
let session = sp.accept_unsolicited_sso(
    idp_descriptor,
    BrowserInput::<SsoResponse>::post(form_fields),
    validation,
)?;
let issuer = session.issuer().as_str();

impl Saml<Sp>

pub fn start_slo( &self, idp: &IdpDescriptor, subject: LogoutSubject, options: StartSlo, ) -> Result<Started<LogoutRequest>, SamlError>

Start SP-initiated Single Logout.

Errors

Returns SamlError when relay state is invalid, IdP metadata cannot be parsed, a compatible logout endpoint or signing key is missing, the selected binding is unsupported, or logout request creation fails.

Examples

use saml_rs::{IdpDescriptor, LogoutSubject, Saml, StartSlo};

let started = sp.start_slo(idp, subject, StartSlo::post())?;
let form = started.outbound.post_form()?;
let snapshot = started.pending.snapshot();

Examples found in repository

examples/slo.rs (line 76)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, LogoutRequest, LogoutResponse, MetadataTrustPolicy,
        NameId, PrivateKeyPem, ReplayPolicy, RespondSlo, RespondSso, Saml, SamlValidationContext,
        SloEndpoint, SpConfig, SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse,
        StartSlo, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .slo_endpoint(SloEndpoint::post("https://sp.example.com/slo")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .slo_endpoint(SloEndpoint::post("https://idp.example.com/slo")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;
    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let sso = sp.start_sso(&idp_descriptor, StartSso::post())?;
    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(sso.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;
    let session = sp.finish_sso(
        &idp_descriptor,
        &sso.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    )?;

    let subject = session
        .logout_subject()
        .ok_or("session has no logout subject")?;
    let logout = sp.start_slo(&idp_descriptor, subject, StartSlo::post())?;
    println!("SP  -> LogoutRequest id = {}", logout.pending.id().as_str());

    let logout_request = idp.receive_slo(
        &sp_descriptor,
        BrowserInput::<LogoutRequest>::post(logout.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let logout_response = idp.respond_slo(
        &sp_descriptor,
        &logout_request,
        RespondSlo::post().relay_state(logout.pending.relay_state().clone()),
    )?;
    let completed = sp.finish_slo(
        &idp_descriptor,
        &logout.pending,
        BrowserInput::<LogoutResponse>::post(logout_response.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "SP  <- LogoutResponse status = {}",
        completed.status().unwrap_or("missing")
    );
    Ok(())
}

pub fn receive_slo( &self, idp: &IdpDescriptor, input: BrowserInput<LogoutRequest>, validation: SamlValidationContext<'_>, ) -> Result<Received<LogoutRequest>, SamlError>

Receive an IdP LogoutRequest.

Errors

Returns SamlError when the browser input or relay state is invalid, the binding is unsupported for logout, IdP metadata cannot be parsed, XML parsing or signature/trust validation fails, the destination does not match local metadata, or replay validation detects a duplicate or expired message.

pub fn respond_slo( &self, idp: &IdpDescriptor, request: &Received<LogoutRequest>, options: RespondSlo, ) -> Result<Outbound<LogoutResponse>, SamlError>

Respond to a received IdP LogoutRequest.

Errors

Returns SamlError when IdP metadata cannot be parsed, relay state is invalid, a compatible logout endpoint or signing key is missing, the selected binding is unsupported, or logout response creation fails.

pub fn finish_slo( &self, idp: &IdpDescriptor, pending: &PendingLogoutRequest, input: BrowserInput<LogoutResponse>, validation: SamlValidationContext<'_>, ) -> Result<LogoutCompleted, SamlError>

Finish SP-initiated Single Logout using stored pending LogoutRequest state.

Errors

Returns SamlError when the response does not match the pending request, including issuer, binding, relay state, destination, or InResponseTo mismatches; when IdP metadata cannot be parsed; when XML, signature, trust, status, or time validation fails; or when replay validation detects a duplicate or expired message.

Examples

use saml_rs::{
    BrowserInput, FormField, IdpDescriptor, LogoutResponse, PendingLogoutRequest,
    ReplayPolicy, Saml, SamlValidationContext,
};
use std::time::SystemTime;

let validation = SamlValidationContext::new(
    SystemTime::now(),
    ReplayPolicy::DisabledForCompatibility,
);
let completed = sp.finish_slo(
    idp,
    pending,
    BrowserInput::<LogoutResponse>::post(fields),
    validation,
)?;

let peer = completed.peer_entity_id().as_str();

Examples found in repository

examples/slo.rs (lines 89-94)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, LogoutRequest, LogoutResponse, MetadataTrustPolicy,
        NameId, PrivateKeyPem, ReplayPolicy, RespondSlo, RespondSso, Saml, SamlValidationContext,
        SloEndpoint, SpConfig, SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse,
        StartSlo, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .slo_endpoint(SloEndpoint::post("https://sp.example.com/slo")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .slo_endpoint(SloEndpoint::post("https://idp.example.com/slo")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;
    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let sso = sp.start_sso(&idp_descriptor, StartSso::post())?;
    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(sso.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;
    let session = sp.finish_sso(
        &idp_descriptor,
        &sso.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    )?;

    let subject = session
        .logout_subject()
        .ok_or("session has no logout subject")?;
    let logout = sp.start_slo(&idp_descriptor, subject, StartSlo::post())?;
    println!("SP  -> LogoutRequest id = {}", logout.pending.id().as_str());

    let logout_request = idp.receive_slo(
        &sp_descriptor,
        BrowserInput::<LogoutRequest>::post(logout.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let logout_response = idp.respond_slo(
        &sp_descriptor,
        &logout_request,
        RespondSlo::post().relay_state(logout.pending.relay_state().clone()),
    )?;
    let completed = sp.finish_slo(
        &idp_descriptor,
        &logout.pending,
        BrowserInput::<LogoutResponse>::post(logout_response.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "SP  <- LogoutResponse status = {}",
        completed.status().unwrap_or("missing")
    );
    Ok(())
}

impl Saml<Idp>

pub fn start_slo( &self, sp: &SpDescriptor, subject: LogoutSubject, options: StartSlo, ) -> Result<Started<LogoutRequest>, SamlError>

Start IdP-initiated Single Logout.

Errors

Returns SamlError when relay state is invalid, SP metadata cannot be parsed, a compatible logout endpoint or signing key is missing, the selected binding is unsupported, or logout request creation fails.

Examples

use saml_rs::{LogoutSubject, Saml, SpDescriptor, StartSlo};

let started = idp.start_slo(sp, subject, StartSlo::post())?;
let form = started.outbound.post_form()?;
let snapshot = started.pending.snapshot();

pub fn receive_slo( &self, sp: &SpDescriptor, input: BrowserInput<LogoutRequest>, validation: SamlValidationContext<'_>, ) -> Result<Received<LogoutRequest>, SamlError>

Receive an SP LogoutRequest.

Errors

Returns SamlError when the browser input or relay state is invalid, the binding is unsupported for logout, SP metadata cannot be parsed, XML parsing or signature/trust validation fails, the destination does not match local metadata, or replay validation detects a duplicate or expired message.

Examples

use saml_rs::{
    BrowserInput, FormField, LogoutRequest, ReplayPolicy, RespondSlo, Saml,
    SamlValidationContext, SpDescriptor,
};
use std::time::SystemTime;

let validation = SamlValidationContext::new(
    SystemTime::now(),
    ReplayPolicy::DisabledForCompatibility,
);
let input = BrowserInput::<LogoutRequest>::post(fields);
let request = idp.receive_slo(sp, input, validation)?;
let response = idp.respond_slo(sp, &request, RespondSlo::post())?;

let form = response.post_form()?;

Examples found in repository

examples/slo.rs (lines 79-83)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, LogoutRequest, LogoutResponse, MetadataTrustPolicy,
        NameId, PrivateKeyPem, ReplayPolicy, RespondSlo, RespondSso, Saml, SamlValidationContext,
        SloEndpoint, SpConfig, SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse,
        StartSlo, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .slo_endpoint(SloEndpoint::post("https://sp.example.com/slo")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .slo_endpoint(SloEndpoint::post("https://idp.example.com/slo")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;
    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let sso = sp.start_sso(&idp_descriptor, StartSso::post())?;
    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(sso.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;
    let session = sp.finish_sso(
        &idp_descriptor,
        &sso.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    )?;

    let subject = session
        .logout_subject()
        .ok_or("session has no logout subject")?;
    let logout = sp.start_slo(&idp_descriptor, subject, StartSlo::post())?;
    println!("SP  -> LogoutRequest id = {}", logout.pending.id().as_str());

    let logout_request = idp.receive_slo(
        &sp_descriptor,
        BrowserInput::<LogoutRequest>::post(logout.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let logout_response = idp.respond_slo(
        &sp_descriptor,
        &logout_request,
        RespondSlo::post().relay_state(logout.pending.relay_state().clone()),
    )?;
    let completed = sp.finish_slo(
        &idp_descriptor,
        &logout.pending,
        BrowserInput::<LogoutResponse>::post(logout_response.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "SP  <- LogoutResponse status = {}",
        completed.status().unwrap_or("missing")
    );
    Ok(())
}

pub fn respond_slo( &self, sp: &SpDescriptor, request: &Received<LogoutRequest>, options: RespondSlo, ) -> Result<Outbound<LogoutResponse>, SamlError>

Respond to a received SP LogoutRequest.

Errors

Returns SamlError when SP metadata cannot be parsed, relay state is invalid, a compatible logout endpoint or signing key is missing, the selected binding is unsupported, or logout response creation fails.

Examples

use saml_rs::{LogoutRequest, Received, RespondSlo, Saml, SpDescriptor};

let response = idp.respond_slo(sp, request, RespondSlo::post())?;
let form = response.post_form()?;

Examples found in repository

examples/slo.rs (lines 84-88)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, LogoutRequest, LogoutResponse, MetadataTrustPolicy,
        NameId, PrivateKeyPem, ReplayPolicy, RespondSlo, RespondSso, Saml, SamlValidationContext,
        SloEndpoint, SpConfig, SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse,
        StartSlo, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .slo_endpoint(SloEndpoint::post("https://sp.example.com/slo")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .slo_endpoint(SloEndpoint::post("https://idp.example.com/slo")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;
    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let sso = sp.start_sso(&idp_descriptor, StartSso::post())?;
    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(sso.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;
    let session = sp.finish_sso(
        &idp_descriptor,
        &sso.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    )?;

    let subject = session
        .logout_subject()
        .ok_or("session has no logout subject")?;
    let logout = sp.start_slo(&idp_descriptor, subject, StartSlo::post())?;
    println!("SP  -> LogoutRequest id = {}", logout.pending.id().as_str());

    let logout_request = idp.receive_slo(
        &sp_descriptor,
        BrowserInput::<LogoutRequest>::post(logout.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let logout_response = idp.respond_slo(
        &sp_descriptor,
        &logout_request,
        RespondSlo::post().relay_state(logout.pending.relay_state().clone()),
    )?;
    let completed = sp.finish_slo(
        &idp_descriptor,
        &logout.pending,
        BrowserInput::<LogoutResponse>::post(logout_response.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "SP  <- LogoutResponse status = {}",
        completed.status().unwrap_or("missing")
    );
    Ok(())
}

pub fn finish_slo( &self, sp: &SpDescriptor, pending: &PendingLogoutRequest, input: BrowserInput<LogoutResponse>, validation: SamlValidationContext<'_>, ) -> Result<LogoutCompleted, SamlError>

Finish IdP-initiated Single Logout using stored pending LogoutRequest state.

Errors

Returns SamlError when the response does not match the pending request, including issuer, binding, relay state, destination, or InResponseTo mismatches; when SP metadata cannot be parsed; when XML, signature, trust, status, or time validation fails; or when replay validation detects a duplicate or expired message.

Examples

use saml_rs::{
    BrowserInput, FormField, LogoutResponse, PendingLogoutRequest, ReplayPolicy,
    Saml, SamlValidationContext, SpDescriptor,
};
use std::time::SystemTime;

let validation = SamlValidationContext::new(
    SystemTime::now(),
    ReplayPolicy::DisabledForCompatibility,
);
let completed = idp.finish_slo(
    sp,
    pending,
    BrowserInput::<LogoutResponse>::post(fields),
    validation,
)?;

let peer = completed.peer_entity_id().as_str();

impl Saml<Sp>

pub fn metadata_xml(&self) -> &str

Local SP metadata XML.

Examples found in repository

examples/sso.rs (line 44)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, MetadataTrustPolicy, NameId, PrivateKeyPem,
        RelayStateParam, ReplayPolicy, RespondSso, Saml, SamlValidationContext, SpConfig,
        SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;

    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let relay_state = RelayStateParam::try_from_option(Some("demo-state".to_string()))?;
    let started = sp.start_sso(&idp_descriptor, StartSso::post().relay_state(relay_state))?;
    println!(
        "SP  -> AuthnRequest id = {}",
        started.pending.request_id().as_str()
    );

    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(started.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "IdP <- request issuer  = {}",
        request.message().issuer().as_str()
    );

    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;

    let session = sp.finish_sso(
        &idp_descriptor,
        &started.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    );
    let session = session?;
    println!("SP  <- authenticated   = {}", session.name_id().value());
    Ok(())
}

examples/slo.rs (line 45)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, LogoutRequest, LogoutResponse, MetadataTrustPolicy,
        NameId, PrivateKeyPem, ReplayPolicy, RespondSlo, RespondSso, Saml, SamlValidationContext,
        SloEndpoint, SpConfig, SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse,
        StartSlo, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .slo_endpoint(SloEndpoint::post("https://sp.example.com/slo")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .slo_endpoint(SloEndpoint::post("https://idp.example.com/slo")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;
    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let sso = sp.start_sso(&idp_descriptor, StartSso::post())?;
    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(sso.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;
    let session = sp.finish_sso(
        &idp_descriptor,
        &sso.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    )?;

    let subject = session
        .logout_subject()
        .ok_or("session has no logout subject")?;
    let logout = sp.start_slo(&idp_descriptor, subject, StartSlo::post())?;
    println!("SP  -> LogoutRequest id = {}", logout.pending.id().as_str());

    let logout_request = idp.receive_slo(
        &sp_descriptor,
        BrowserInput::<LogoutRequest>::post(logout.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let logout_response = idp.respond_slo(
        &sp_descriptor,
        &logout_request,
        RespondSlo::post().relay_state(logout.pending.relay_state().clone()),
    )?;
    let completed = sp.finish_slo(
        &idp_descriptor,
        &logout.pending,
        BrowserInput::<LogoutResponse>::post(logout_response.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "SP  <- LogoutResponse status = {}",
        completed.status().unwrap_or("missing")
    );
    Ok(())
}

pub fn raw_service_provider(&self) -> &ServiceProvider

Raw compatibility Service Provider.

pub fn start_sso( &self, idp: &IdpDescriptor, options: StartSso, ) -> Result<Started<AuthnRequest>, SamlError>

Start SP-initiated Web SSO.

Errors

Returns SamlError when relay state is invalid, the IdP metadata cannot be parsed or trusted, the requested ACS is missing or conflicts with the selected binding, or request creation fails because required metadata, signing keys, or supported bindings are unavailable.

Examples

use saml_rs::{
    AcsEndpoint, EntityId, IdpConfig, IdpDescriptor, IdpValidationPolicy,
    MetadataTrustPolicy, RelayStateParam, Saml, SpConfig, SpValidationPolicy,
    SsoEndpoint, StartSso,
};

let sp_config = SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
    .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
    .validation(SpValidationPolicy::compatibility())
    .build()?;
let idp_config = IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
    .sso_endpoint(SsoEndpoint::redirect("https://idp.example.com/sso")?)
    .validation(IdpValidationPolicy::compatibility())
    .build()?;

let sp = Saml::sp(sp_config)?;
let idp = Saml::idp(idp_config)?;
let idp = IdpDescriptor::from_metadata_xml(
    idp.metadata_xml(),
    MetadataTrustPolicy::UnsignedForCompatibility,
)?;
let relay_state = RelayStateParam::try_from_option(Some("state".to_string()))?;
let started = sp.start_sso(&idp, StartSso::redirect().relay_state(relay_state))?;

let redirect_url = started.outbound.redirect_url()?;

Examples found in repository

examples/sso.rs (line 54)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, MetadataTrustPolicy, NameId, PrivateKeyPem,
        RelayStateParam, ReplayPolicy, RespondSso, Saml, SamlValidationContext, SpConfig,
        SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;

    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let relay_state = RelayStateParam::try_from_option(Some("demo-state".to_string()))?;
    let started = sp.start_sso(&idp_descriptor, StartSso::post().relay_state(relay_state))?;
    println!(
        "SP  -> AuthnRequest id = {}",
        started.pending.request_id().as_str()
    );

    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(started.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "IdP <- request issuer  = {}",
        request.message().issuer().as_str()
    );

    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;

    let session = sp.finish_sso(
        &idp_descriptor,
        &started.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    );
    let session = session?;
    println!("SP  <- authenticated   = {}", session.name_id().value());
    Ok(())
}

examples/slo.rs (line 54)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, LogoutRequest, LogoutResponse, MetadataTrustPolicy,
        NameId, PrivateKeyPem, ReplayPolicy, RespondSlo, RespondSso, Saml, SamlValidationContext,
        SloEndpoint, SpConfig, SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse,
        StartSlo, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .slo_endpoint(SloEndpoint::post("https://sp.example.com/slo")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .slo_endpoint(SloEndpoint::post("https://idp.example.com/slo")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;
    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let sso = sp.start_sso(&idp_descriptor, StartSso::post())?;
    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(sso.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;
    let session = sp.finish_sso(
        &idp_descriptor,
        &sso.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    )?;

    let subject = session
        .logout_subject()
        .ok_or("session has no logout subject")?;
    let logout = sp.start_slo(&idp_descriptor, subject, StartSlo::post())?;
    println!("SP  -> LogoutRequest id = {}", logout.pending.id().as_str());

    let logout_request = idp.receive_slo(
        &sp_descriptor,
        BrowserInput::<LogoutRequest>::post(logout.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let logout_response = idp.respond_slo(
        &sp_descriptor,
        &logout_request,
        RespondSlo::post().relay_state(logout.pending.relay_state().clone()),
    )?;
    let completed = sp.finish_slo(
        &idp_descriptor,
        &logout.pending,
        BrowserInput::<LogoutResponse>::post(logout_response.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "SP  <- LogoutResponse status = {}",
        completed.status().unwrap_or("missing")
    );
    Ok(())
}

pub fn finish_sso( &self, idp: &IdpDescriptor, pending: &PendingAuthnRequest, input: BrowserInput<SsoResponse>, validation: SamlValidationContext<'_>, ) -> Result<SsoSession, SamlError>

Finish SP-initiated SSO using stored pending AuthnRequest state.

Errors

Returns SamlError when the response does not match the pending request, including issuer, binding, relay state, destination, recipient, or InResponseTo mismatches; when XML, signature, certificate trust, audience, or time-window validation fails; or when replay validation returns ReplayDetected or TimeWindowInvalid.

Examples

use saml_rs::{
    BrowserInput, FormField, IdpDescriptor, PendingAuthnRequest, ReplayPolicy, Saml,
    SamlValidationContext, SsoResponse,
};
use std::time::SystemTime;

let validation = SamlValidationContext::new(
    SystemTime::now(),
    ReplayPolicy::DisabledForCompatibility,
);
let input = BrowserInput::<SsoResponse>::post(fields);
let session = sp.finish_sso(idp, pending, input, validation)?;

let name_id = session.name_id().value();

Examples found in repository

examples/sso.rs (lines 77-82)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, MetadataTrustPolicy, NameId, PrivateKeyPem,
        RelayStateParam, ReplayPolicy, RespondSso, Saml, SamlValidationContext, SpConfig,
        SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;

    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let relay_state = RelayStateParam::try_from_option(Some("demo-state".to_string()))?;
    let started = sp.start_sso(&idp_descriptor, StartSso::post().relay_state(relay_state))?;
    println!(
        "SP  -> AuthnRequest id = {}",
        started.pending.request_id().as_str()
    );

    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(started.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "IdP <- request issuer  = {}",
        request.message().issuer().as_str()
    );

    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;

    let session = sp.finish_sso(
        &idp_descriptor,
        &started.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    );
    let session = session?;
    println!("SP  <- authenticated   = {}", session.name_id().value());
    Ok(())
}

examples/slo.rs (lines 66-71)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, LogoutRequest, LogoutResponse, MetadataTrustPolicy,
        NameId, PrivateKeyPem, ReplayPolicy, RespondSlo, RespondSso, Saml, SamlValidationContext,
        SloEndpoint, SpConfig, SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse,
        StartSlo, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .slo_endpoint(SloEndpoint::post("https://sp.example.com/slo")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .slo_endpoint(SloEndpoint::post("https://idp.example.com/slo")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;
    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let sso = sp.start_sso(&idp_descriptor, StartSso::post())?;
    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(sso.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;
    let session = sp.finish_sso(
        &idp_descriptor,
        &sso.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    )?;

    let subject = session
        .logout_subject()
        .ok_or("session has no logout subject")?;
    let logout = sp.start_slo(&idp_descriptor, subject, StartSlo::post())?;
    println!("SP  -> LogoutRequest id = {}", logout.pending.id().as_str());

    let logout_request = idp.receive_slo(
        &sp_descriptor,
        BrowserInput::<LogoutRequest>::post(logout.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let logout_response = idp.respond_slo(
        &sp_descriptor,
        &logout_request,
        RespondSlo::post().relay_state(logout.pending.relay_state().clone()),
    )?;
    let completed = sp.finish_slo(
        &idp_descriptor,
        &logout.pending,
        BrowserInput::<LogoutResponse>::post(logout_response.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "SP  <- LogoutResponse status = {}",
        completed.status().unwrap_or("missing")
    );
    Ok(())
}

pub fn accept_unsolicited_sso( &self, idp: &IdpDescriptor, input: BrowserInput<SsoResponse>, validation: SamlValidationContext<'_>, ) -> Result<SsoSession, SamlError>

Accept an IdP-initiated SSO response explicitly.

Errors

Returns SamlError when the browser binding is not valid for SSO responses, the IdP metadata cannot be parsed or trusted, XML parsing or signature verification fails, destination, recipient, audience, or time validation fails, or replay validation returns ReplayDetected or TimeWindowInvalid.

impl Saml

pub fn sp(config: SpConfig) -> Result<Saml<Sp>, SamlError>

Build a typed Service Provider facade.

Errors

Returns SamlError when the SP config cannot be converted into raw settings or metadata, including missing metadata, missing keys, or unsupported crypto configuration.

Examples found in repository

examples/sso.rs (lines 27-33)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, MetadataTrustPolicy, NameId, PrivateKeyPem,
        RelayStateParam, ReplayPolicy, RespondSso, Saml, SamlValidationContext, SpConfig,
        SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;

    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let relay_state = RelayStateParam::try_from_option(Some("demo-state".to_string()))?;
    let started = sp.start_sso(&idp_descriptor, StartSso::post().relay_state(relay_state))?;
    println!(
        "SP  -> AuthnRequest id = {}",
        started.pending.request_id().as_str()
    );

    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(started.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "IdP <- request issuer  = {}",
        request.message().issuer().as_str()
    );

    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;

    let session = sp.finish_sso(
        &idp_descriptor,
        &started.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    );
    let session = session?;
    println!("SP  <- authenticated   = {}", session.name_id().value());
    Ok(())
}

examples/slo.rs (lines 27-34)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, LogoutRequest, LogoutResponse, MetadataTrustPolicy,
        NameId, PrivateKeyPem, ReplayPolicy, RespondSlo, RespondSso, Saml, SamlValidationContext,
        SloEndpoint, SpConfig, SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse,
        StartSlo, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .slo_endpoint(SloEndpoint::post("https://sp.example.com/slo")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .slo_endpoint(SloEndpoint::post("https://idp.example.com/slo")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;
    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let sso = sp.start_sso(&idp_descriptor, StartSso::post())?;
    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(sso.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;
    let session = sp.finish_sso(
        &idp_descriptor,
        &sso.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    )?;

    let subject = session
        .logout_subject()
        .ok_or("session has no logout subject")?;
    let logout = sp.start_slo(&idp_descriptor, subject, StartSlo::post())?;
    println!("SP  -> LogoutRequest id = {}", logout.pending.id().as_str());

    let logout_request = idp.receive_slo(
        &sp_descriptor,
        BrowserInput::<LogoutRequest>::post(logout.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let logout_response = idp.respond_slo(
        &sp_descriptor,
        &logout_request,
        RespondSlo::post().relay_state(logout.pending.relay_state().clone()),
    )?;
    let completed = sp.finish_slo(
        &idp_descriptor,
        &logout.pending,
        BrowserInput::<LogoutResponse>::post(logout_response.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "SP  <- LogoutResponse status = {}",
        completed.status().unwrap_or("missing")
    );
    Ok(())
}

pub fn idp(config: IdpConfig) -> Result<Saml<Idp>, SamlError>

Build a typed Identity Provider facade.

Errors

Returns SamlError when the IdP config cannot be converted into raw settings or metadata, including missing metadata, missing keys, or unsupported crypto configuration.

Examples found in repository

examples/sso.rs (lines 34-40)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, MetadataTrustPolicy, NameId, PrivateKeyPem,
        RelayStateParam, ReplayPolicy, RespondSso, Saml, SamlValidationContext, SpConfig,
        SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;

    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let relay_state = RelayStateParam::try_from_option(Some("demo-state".to_string()))?;
    let started = sp.start_sso(&idp_descriptor, StartSso::post().relay_state(relay_state))?;
    println!(
        "SP  -> AuthnRequest id = {}",
        started.pending.request_id().as_str()
    );

    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(started.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "IdP <- request issuer  = {}",
        request.message().issuer().as_str()
    );

    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;

    let session = sp.finish_sso(
        &idp_descriptor,
        &started.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    );
    let session = session?;
    println!("SP  <- authenticated   = {}", session.name_id().value());
    Ok(())
}

examples/slo.rs (lines 35-42)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, LogoutRequest, LogoutResponse, MetadataTrustPolicy,
        NameId, PrivateKeyPem, ReplayPolicy, RespondSlo, RespondSso, Saml, SamlValidationContext,
        SloEndpoint, SpConfig, SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse,
        StartSlo, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .slo_endpoint(SloEndpoint::post("https://sp.example.com/slo")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .slo_endpoint(SloEndpoint::post("https://idp.example.com/slo")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;
    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let sso = sp.start_sso(&idp_descriptor, StartSso::post())?;
    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(sso.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;
    let session = sp.finish_sso(
        &idp_descriptor,
        &sso.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    )?;

    let subject = session
        .logout_subject()
        .ok_or("session has no logout subject")?;
    let logout = sp.start_slo(&idp_descriptor, subject, StartSlo::post())?;
    println!("SP  -> LogoutRequest id = {}", logout.pending.id().as_str());

    let logout_request = idp.receive_slo(
        &sp_descriptor,
        BrowserInput::<LogoutRequest>::post(logout.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let logout_response = idp.respond_slo(
        &sp_descriptor,
        &logout_request,
        RespondSlo::post().relay_state(logout.pending.relay_state().clone()),
    )?;
    let completed = sp.finish_slo(
        &idp_descriptor,
        &logout.pending,
        BrowserInput::<LogoutResponse>::post(logout_response.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "SP  <- LogoutResponse status = {}",
        completed.status().unwrap_or("missing")
    );
    Ok(())
}