Struct Pending 

pub struct Pending<Message: PendingMessage> { /* private fields */ }

Pending SAML message correlation state.

Implementations

impl<Message: PendingMessage> Pending<Message>

pub fn with_issue_instant(self, issued_at: SamlInstant) -> Self

Record an issue instant.

pub fn with_expiration(self, expires_at: SamlInstant) -> Self

Record an expiration instant.

pub fn id(&self) -> &MessageId

SAML protocol message ID.

Examples found in repository

examples/slo.rs (line 77)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, LogoutRequest, LogoutResponse, MetadataTrustPolicy,
        NameId, PrivateKeyPem, ReplayPolicy, RespondSlo, RespondSso, Saml, SamlValidationContext,
        SloEndpoint, SpConfig, SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse,
        StartSlo, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .slo_endpoint(SloEndpoint::post("https://sp.example.com/slo")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .slo_endpoint(SloEndpoint::post("https://idp.example.com/slo")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;
    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let sso = sp.start_sso(&idp_descriptor, StartSso::post())?;
    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(sso.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;
    let session = sp.finish_sso(
        &idp_descriptor,
        &sso.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    )?;

    let subject = session
        .logout_subject()
        .ok_or("session has no logout subject")?;
    let logout = sp.start_slo(&idp_descriptor, subject, StartSlo::post())?;
    println!("SP  -> LogoutRequest id = {}", logout.pending.id().as_str());

    let logout_request = idp.receive_slo(
        &sp_descriptor,
        BrowserInput::<LogoutRequest>::post(logout.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let logout_response = idp.respond_slo(
        &sp_descriptor,
        &logout_request,
        RespondSlo::post().relay_state(logout.pending.relay_state().clone()),
    )?;
    let completed = sp.finish_slo(
        &idp_descriptor,
        &logout.pending,
        BrowserInput::<LogoutResponse>::post(logout_response.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "SP  <- LogoutResponse status = {}",
        completed.status().unwrap_or("missing")
    );
    Ok(())
}

pub fn relay_state(&self) -> &RelayStateParam

RelayState state.

Examples found in repository

examples/slo.rs (line 87)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, LogoutRequest, LogoutResponse, MetadataTrustPolicy,
        NameId, PrivateKeyPem, ReplayPolicy, RespondSlo, RespondSso, Saml, SamlValidationContext,
        SloEndpoint, SpConfig, SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse,
        StartSlo, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .slo_endpoint(SloEndpoint::post("https://sp.example.com/slo")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .slo_endpoint(SloEndpoint::post("https://idp.example.com/slo")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;
    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let sso = sp.start_sso(&idp_descriptor, StartSso::post())?;
    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(sso.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;
    let session = sp.finish_sso(
        &idp_descriptor,
        &sso.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    )?;

    let subject = session
        .logout_subject()
        .ok_or("session has no logout subject")?;
    let logout = sp.start_slo(&idp_descriptor, subject, StartSlo::post())?;
    println!("SP  -> LogoutRequest id = {}", logout.pending.id().as_str());

    let logout_request = idp.receive_slo(
        &sp_descriptor,
        BrowserInput::<LogoutRequest>::post(logout.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    let logout_response = idp.respond_slo(
        &sp_descriptor,
        &logout_request,
        RespondSlo::post().relay_state(logout.pending.relay_state().clone()),
    )?;
    let completed = sp.finish_slo(
        &idp_descriptor,
        &logout.pending,
        BrowserInput::<LogoutResponse>::post(logout_response.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "SP  <- LogoutResponse status = {}",
        completed.status().unwrap_or("missing")
    );
    Ok(())
}

pub fn peer_entity_id(&self) -> &EntityId

Peer entity ID.

pub fn issued_at(&self) -> Option<&SamlInstant>

Issue instant, if recorded.

pub fn expires_at(&self) -> Option<&SamlInstant>

Expiration instant, if recorded.

impl Pending<AuthnRequest>

pub fn try_new( request_id: MessageId, relay_state: RelayStateParam, acs: AcsEndpoint, response_binding: SsoResponseBinding, idp_entity_id: EntityId, ) -> Result<Self, SamlError>

Create pending AuthnRequest state without storing keys or metadata.

Errors

Returns SamlError::Invalid when the RelayState state is malformed, the IdP entity ID is empty, or the selected ACS binding does not match the expected response binding.

pub fn with_request_binding(self, request_binding: SsoRequestBinding) -> Self

Record the outbound AuthnRequest binding selected for dispatch.

pub fn from_snapshot( snapshot: PendingSnapshot<AuthnRequest>, ) -> Result<Self, SamlError>

Reconstruct pending AuthnRequest state from a snapshot.

Errors

Returns SamlError when any snapshot field is malformed or inconsistent.

Examples

use saml_rs::{AuthnRequest, Pending, PendingSnapshot, RelayStateParam};

let snapshot = PendingSnapshot::<AuthnRequest>::authn_request(
    "_request123",
    RelayStateParam::absent(),
    "https://idp.example.com/metadata",
    "post",
    "https://sp.example.com/acs",
    "post",
);
let pending = Pending::<AuthnRequest>::from_snapshot(snapshot)?;

assert_eq!(pending.idp_entity_id().as_str(), "https://idp.example.com/metadata");

pub fn snapshot(&self) -> PendingSnapshot<AuthnRequest>

Build a persistable snapshot.

pub fn request_id(&self) -> &MessageId

Request ID.

Examples found in repository

examples/sso.rs (line 57)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    use saml_rs::{
        AcsEndpoint, AuthnRequest, BrowserInput, CertificatePem, Credentials, EntityId, IdpConfig,
        IdpDescriptor, IdpValidationPolicy, MetadataTrustPolicy, NameId, PrivateKeyPem,
        RelayStateParam, ReplayPolicy, RespondSso, Saml, SamlValidationContext, SpConfig,
        SpDescriptor, SpValidationPolicy, SsoEndpoint, SsoResponse, StartSso, Subject,
    };
    use std::time::SystemTime;

    let privkey = include_str!("../tests/fixtures/key/sp_privkey.pem");
    let cert = include_str!("../tests/fixtures/key/sp_signing_cert.cer");
    let credentials = || Credentials {
        signing_key: Some(PrivateKeyPem::new(privkey)),
        signing_certificate: Some(CertificatePem::new(cert)),
        ..Credentials::default()
    };
    let validation =
        || SamlValidationContext::new(SystemTime::now(), ReplayPolicy::DisabledForCompatibility);

    let sp = Saml::sp(
        SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
            .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
            .credentials(credentials())
            .validation(SpValidationPolicy::strict())
            .build()?,
    )?;
    let idp = Saml::idp(
        IdpConfig::builder(EntityId::try_new("https://idp.example.com/metadata")?)
            .sso_endpoint(SsoEndpoint::post("https://idp.example.com/sso")?)
            .credentials(credentials())
            .validation(IdpValidationPolicy::strict())
            .build()?,
    )?;

    let sp_descriptor = SpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://sp.example.com/metadata")?,
        sp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;
    let idp_descriptor = IdpDescriptor::from_metadata_xml_for(
        EntityId::try_new("https://idp.example.com/metadata")?,
        idp.metadata_xml(),
        MetadataTrustPolicy::UnsignedForCompatibility,
    )?;

    let relay_state = RelayStateParam::try_from_option(Some("demo-state".to_string()))?;
    let started = sp.start_sso(&idp_descriptor, StartSso::post().relay_state(relay_state))?;
    println!(
        "SP  -> AuthnRequest id = {}",
        started.pending.request_id().as_str()
    );

    let request = idp.receive_sso(
        &sp_descriptor,
        BrowserInput::<AuthnRequest>::post(started.outbound.post_form()?.fields().to_vec()),
        validation(),
    )?;
    println!(
        "IdP <- request issuer  = {}",
        request.message().issuer().as_str()
    );

    let response = idp.respond_sso(
        &sp_descriptor,
        &request,
        Subject::new(NameId::new("alice@example.com", None), Vec::new()),
        RespondSso::post(),
    )?;

    let session = sp.finish_sso(
        &idp_descriptor,
        &started.pending,
        BrowserInput::<SsoResponse>::post(response.post_form()?.fields().to_vec()),
        validation(),
    );
    let session = session?;
    println!("SP  <- authenticated   = {}", session.name_id().value());
    Ok(())
}

pub fn request_binding(&self) -> Option<SsoRequestBinding>

Request binding, when tracked.

pub fn response_binding(&self) -> SsoResponseBinding

Expected response binding.

pub fn acs(&self) -> &AcsEndpoint

Selected ACS endpoint.

pub fn idp_entity_id(&self) -> &EntityId

Selected IdP entity ID.

impl Pending<LogoutRequest>

pub fn try_new( request_id: MessageId, relay_state: RelayStateParam, binding: LogoutBinding, peer_entity_id: EntityId, ) -> Result<Self, SamlError>

Create pending LogoutRequest state without storing keys or metadata.

Errors

Returns SamlError::Invalid when RelayState or peer entity ID are malformed.

pub fn from_snapshot( snapshot: PendingSnapshot<LogoutRequest>, ) -> Result<Self, SamlError>

Reconstruct pending LogoutRequest state from a snapshot.

AuthnRequest-only ACS snapshot fields are ignored.

Errors

Returns SamlError when any snapshot field is malformed or inconsistent.

Examples

use saml_rs::{LogoutBinding, LogoutRequest, Pending, PendingSnapshot, RelayStateParam};

let snapshot = PendingSnapshot::<LogoutRequest>::logout_request(
    "_logout123",
    RelayStateParam::absent(),
    "https://idp.example.com/metadata",
    LogoutBinding::Post,
);
let pending = Pending::<LogoutRequest>::from_snapshot(snapshot)?;

assert_eq!(pending.peer_entity_id().as_str(), "https://idp.example.com/metadata");

pub fn snapshot(&self) -> PendingSnapshot<LogoutRequest>

Build a persistable snapshot.

pub fn request_binding(&self) -> LogoutBinding

Logout request binding selected for dispatch.

pub fn response_binding(&self) -> LogoutBinding

Expected logout response binding.

Trait Implementations

impl<Message: Clone + PendingMessage> Clone for Pending<Message>

where Message::Details: Clone,

fn clone(&self) -> Pending<Message>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<Message: Debug + PendingMessage> Debug for Pending<Message>

where Message::Details: Debug,

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<Message: Eq + PendingMessage> Eq for Pending<Message>

where Message::Details: Eq,

impl<Message: PartialEq + PendingMessage> PartialEq for Pending<Message>

where Message::Details: PartialEq,

fn eq(&self, other: &Pending<Message>) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl<Message: PartialEq + PendingMessage> StructuralPartialEq for Pending<Message>

where Message::Details: PartialEq,