Struct SsoSession 

pub struct SsoSession { /* private fields */ }

Parsed SSO login session.

Implementations

impl SsoSession

pub fn response_id(&self) -> &MessageId

Response ID.

pub fn response_issue_instant(&self) -> &SamlInstant

Response IssueInstant, normalized according to XML Schema whitespace rules.

pub fn assertion_id(&self) -> &AssertionId

Assertion ID.

pub fn assertion_issue_instant(&self) -> &SamlInstant

Selected assertion IssueInstant, normalized according to XML Schema whitespace rules.

pub fn issuer(&self) -> &EntityId

Assertion issuer.

pub fn in_response_to(&self) -> Option<&MessageId>

InResponseTo, when present.

pub fn subject(&self) -> &Subject

Subject.

pub fn name_id(&self) -> &NameId

Subject NameID.

Examples found in repository

examples/sso.rs (line 95)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, MetadataTrustPolicy, NameId, PrivateKeyPem,
        RelayStateParam, ReplayPolicy, RespondSso, Saml, SamlValidationContext, SpConfig,
        SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    // DisabledForCompatibility preserves the raw API, which has no replay cache.
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;

    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        // UnsignedForCompatibility preserves an unsigned samlify-port metadata import.
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        // UnsignedForCompatibility preserves an unsigned samlify-port metadata import.
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let relay_state = RelayStateParam::try_from_option(Some("demo-state".to_string()))?;
    let started = sp.start_sso(&idp_descriptor, StartSso::post().relay_state(relay_state))?;
    println!(
        "SP  -> AuthnRequest id = {}",
        started.pending.request_id().as_str()
    );

    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(started.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "IdP <- request issuer  = {}",
        request.message().issuer().as_str()
    );

    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;

    let session = sp.finish_sso(
        &idp_descriptor,
        &started.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    );
    let session = session?;
    println!("SP  <- authenticated   = {}", session.name_id().value());
    Ok(())
}

pub fn attributes(&self) -> &Attributes

Attributes.

pub fn authn_session(&self) -> &AuthnSession

Legacy singular view of AuthnStatement session data.

This compatibility accessor returns the first statement in document order. For assertions containing multiple statements, use Self::authn_sessions. When no statement is present, it returns an immutable empty AuthnSession.

pub fn authn_sessions(&self) -> &[AuthnSession]

Every AuthnStatement session tuple in XML document order.

pub fn audience(&self) -> &[EntityId]

Audience restrictions.

pub fn not_before(&self) -> Option<&SamlInstant>

Conditions NotBefore.

pub fn not_on_or_after(&self) -> Option<&SamlInstant>

Conditions NotOnOrAfter.

pub fn sig_alg(&self) -> Option<&str>

Verified detached Redirect or HTTP-POST-SimpleSign algorithm, when applicable.

Embedded XML signatures are exposed separately through Self::verified_xml_signatures because a message can contain multiple verified signatures with different algorithms and coverage.

pub fn verified_xml_signatures(&self) -> &[VerifiedXmlSignature]

Successfully verified embedded XML signatures that authenticate this session’s Response root or consumed Assertion.

Each item is bound to one exact verifier-approved signature node and its verified references. Invalid, untrusted, malformed, or unrelated signatures are not included. The view preserves distinct signatures; it does not select a signature by XML order. Applications may inspect the reported algorithm URIs to enforce their own allowlist.

pub fn assertion(&self) -> Assertion

Assertion view.

pub fn logout_subject(&self) -> Option<LogoutSubject>

Subject data suitable for issuing Single Logout.

Every present SessionIndex is included in AuthnStatement document order.

Examples

use saml_rs::{IdpDescriptor, Saml, SamlError, SsoSession, StartSlo};

let subject = session
    .logout_subject()
    .ok_or_else(|| SamlError::Invalid("missing logout subject".into()))?;
let started = sp.start_slo(idp, subject, StartSlo::redirect())?;

let redirect_url = started.outbound.redirect_url()?;

Examples found in repository

examples/slo.rs (line 85)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, LogoutRequest, LogoutResponse, MetadataTrustPolicy,
        NameId, PrivateKeyPem, ReplayPolicy, RespondSlo, RespondSso, Saml, SamlValidationContext,
        SloEndpoint, SpConfig, SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse,
        StartSlo, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    // DisabledForCompatibility preserves the raw API, which has no replay cache.
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .slo_endpoint(SloEndpoint::post("https://sp.example.com/slo")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .slo_endpoint(SloEndpoint::post("https://idp.example.com/slo")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;
    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        // UnsignedForCompatibility preserves an unsigned samlify-port metadata import.
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        // UnsignedForCompatibility preserves an unsigned samlify-port metadata import.
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let sso = sp.start_sso(&idp_descriptor, StartSso::post())?;
    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(sso.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;
    let session = sp.finish_sso(
        &idp_descriptor,
        &sso.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    )?;

    let subject = session
        .logout_subject()
        .ok_or("session has no logout subject")?;
    let logout = sp.start_slo(&idp_descriptor, subject, StartSlo::post())?;
    println!("SP  -> LogoutRequest id = {}", logout.pending.id().as_str());

    let logout_request = idp.receive_slo(
        &sp_descriptor,
        BrowserInput::<LogoutRequest>::post(logout.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let logout_response = idp.respond_slo(
        &sp_descriptor,
        &logout_request,
        RespondSlo::post().relay_state(logout.pending.relay_state().clone()),
    )?;
    let completed = sp.finish_slo(
        &idp_descriptor,
        &logout.pending,
        BrowserInput::<LogoutResponse>::post(logout_response.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "SP  <- LogoutResponse status = {}",
        completed.status().unwrap_or("missing")
    );
    Ok(())
}

pub fn replay_keys(&self) -> Vec<ReplayKey>

Replay keys available from this validated SSO session.

pub fn check_and_store_replay( &self, validation: &mut SamlValidationContext<'_>, ) -> Result<(), SamlError>

Check and store this session’s replay keys using the caller cache.

This method is intended for typed inbound SSO facades. It should be called only after signature, issuer, audience, destination, recipient, InResponseTo, and time validation have already passed.

The bearer assertion identifier is kept until SubjectConfirmationData@NotOnOrAfter plus skew. An earlier Conditions or AuthnStatement instant does not shorten it. The Response identifier still expires at the earliest bound. Every direct assertion identifier is stored. Another assertion uses its own bearer NotOnOrAfter when that attribute is present.

Errors

Returns SamlError::TimeWindowInvalid when no valid replay expiration can be derived or a stored deadline has already passed. Nothing is stored in that case. Returns SamlError::ReplayDetected when any session replay key has already been seen. Cache implementations may also return storage-specific failures mapped to SamlError.

pub fn raw_flow(&self) -> &FlowResult

Raw validated flow result.

Trait Implementations

impl Clone for SsoSession

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SsoSession

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl TryFrom<FlowResult> for SsoSession

type Error = SamlError

The type returned in the event of a conversion error.

fn try_from(raw_flow: FlowResult) -> Result<Self, Self::Error>

Performs the conversion.