saml

package module
v0.0.0-...-5f7f1f2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 3, 2018 License: MIT Imports: 15 Imported by: 0

README

go-saml

A just good enough SAML client library written in Go. This library is by no means complete and has been developed to solve several specific integration efforts. However, it's a start, and it would be great to see it evolve into a more fleshed out implemention.

Inspired by the early work of RobotsAndPencils.

The library supports:

  • generating signed/unsigned AuthnRequests
  • validating signed AuthnRequests
  • generating service provider metadata
  • generating signed Responses
  • validating signed Responses

Installation

$ go get github.com/xionglun/saml

Usage

Below are samples to show how you might use the library.

Generating Signed AuthnRequests
sp := saml.ServiceProviderSettings{
  IDPSSOURL:                   "http://idp/saml2",
  IDPSSODescriptorURL:         "http://idp/issuer",
  IDPPublicCertPath:           "certs/idp.crt",
  SPSignRequest:               "true",
  AssertionConsumerServiceURL: "http://localhost:8000/saml_consume",
}
sp.Init()

// generate the AuthnRequest and then get a base64 encoded string of the XML
authnRequest := sp.GetAuthnRequest()
b64XML, err := authnRequest.EncodedSignedString(sp.PrivateKeyPath)
if err != nil {
  panic(err)
}

// for convenience, get a URL formed with the SAMLRequest parameter
url, err := saml.GetAuthnRequestURL(sp.IDPSSOURL, b64XML)
if err != nil {
  panic(err)
}

// below is bonus for how you might respond to a request with a form that POSTs to the IdP
data := struct {
  Base64AuthRequest string
  URL               string
}{
  Base64AuthRequest: b64XML,
  URL:               url,
}

t := template.New("saml")
t, err = t.Parse("<html><body style=\"display: none\" onload=\"document.frm.submit()\"><form method=\"post\" name=\"frm\" action=\"{{.URL}}\"><input type=\"hidden\" name=\"SAMLRequest\" value=\"{{.Base64AuthRequest}}\" /><input type=\"submit\" value=\"Submit\" /></form></body></html>")

// how you might respond to a request with the templated form that will auto post
t.Execute(w, data)
Validating a received SAML Response
response = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
  encodedXML := r.FormValue("SAMLResponse")

  if encodedXML == "" {
    httpcommon.SendBadRequest(w, "SAMLResponse form value missing")
    return
  }

  response, err := saml.ParseEncodedResponse(encodedXML)
  if err != nil {
    httpcommon.SendBadRequest(w, "SAMLResponse parse: "+err.Error())
    return
  }

  err = response.Validate(&sp)
  if err != nil {
    httpcommon.SendBadRequest(w, "SAMLResponse validation: "+err.Error())
    return
  }

  samlID := response.GetAttribute("uid")
  if samlID == "" {
    httpcommon.SendBadRequest(w, "SAML attribute identifier uid missing")
    return
  }

  //...
}
Service provider metadata
func samlMetadataHandler(sp *saml.ServiceProviderSettings) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		md, err := sp.GetEntityDescriptor()
		if err != nil {
      w.WriteHeader(500)
      w.Write([]byte("Error: " + err.Error()))
			return
		}

		w.Header().Set("Content-Type", "application/xml")
		w.Write([]byte(md))
	})
}
Receiving a authnRequest
b64Request := r.URL.Query().Get("SAMLRequest")
if b64Request == "" {
  w.WriteHeader(400)
  w.Write([]byte("SAMLRequest parameter missing"))
  return
}

defated, err := base64.StdEncoding.DecodeString(b64Request)
if err != nil {
  w.WriteHeader(500)
  w.Write([]byte("Error: " + err.Error()))
  return
}

// enflate and unmarshal
var buffer bytes.Buffer
rdr := flate.NewReader(bytes.NewReader(defated))
io.Copy(&buffer, rdr)
var authnRequest saml.AuthnRequest

err = xml.Unmarshal(buffer.Bytes(), &authnRequest)
if err != nil {
  w.WriteHeader(500)
  w.Write([]byte("Error: " + err.Error()))
  return
}

if authnRequest.Issuer.Url != issuerURL {
  w.WriteHeader(500)
  w.Write([]byte("unauthorized issuer "+authnRequest.Issuer.Url))
  return
}

Creating a SAML Response (if acting as an IdP)
issuer := "http://localhost:8000/saml"
authnResponse := saml.NewSignedResponse()
authnResponse.Issuer.Url = issuer
authnResponse.Assertion.Issuer.Url = issuer
authnResponse.Signature.KeyInfo.X509Data.X509Certificate.Cert = stringValueOfCert
authnResponse.Assertion.Subject.NameID.Value = userIdThatYouAuthenticated
authnResponse.AddAttribute("uid", userIdThatYouAuthenticated)
authnResponse.AddAttribute("email", "someone@domain")
authnResponse.Assertion.Subject.SubjectConfirmation.SubjectConfirmationData.InResponseTo = authnRequestIdRespondingTo
authnResponse.InResponseTo = authnRequestIdRespondingTo
authnResponse.Assertion.Subject.SubjectConfirmation.SubjectConfirmationData.Recipient = issuer

// signed XML string
signed, err := authnResponse.SignedString("/path/to/private.key")

// or signed base64 encoded XML string
b64XML, err := authnResponse.EncodedSignedString("/path/to/private.key")

Contributing

Would love any contributions you having including better documentation, tests, or more robust functionality.

git clone git@github.com:xionglun/saml.git
make init
make test
License

The MIT License (MIT)

Copyright (c) 2016 Allen Heavey

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Documentation

Index

Constants

View Source
const (
	RESP_STATUS_SUCCESS                    = "urn:oasis:names:tc:SAML:2.0:status:Success"
	RESP_STATUS_REQUESTER                  = "urn:oasis:names:tc:SAML:2.0:status:Requester"
	RESP_STATUS_RESPONDER                  = "urn:oasis:names:tc:SAML:2.0:status:Responder"
	RESP_STATUS_VERSION_MISMATCH           = "urn:oasis:names:tc:SAML:2.0:status:VersionMismatch"
	RESP_STATUS_AUTHN_FAILED               = "urn:oasis:names:tc:SAML:2.0:status:AuthnFailed"
	RESP_STATUS_INVALID_ATTR_NAME_OR_VALUE = "urn:oasis:names:tc:SAML:2.0:status:InvalidAttrNameOrValue"
	RESP_STATUS_INVALID_NAMEID_POLICY      = "urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"
	RESP_STATUS_NO_AUTHN_CONTEXT           = "urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext"
	RESP_STATUS_NO_AVAILABLE_IDP           = "urn:oasis:names:tc:SAML:2.0:status:NoAvailableIDP"
	RESP_STATUS_NO_PASSIVE                 = "urn:oasis:names:tc:SAML:2.0:status:NoPassive"
	RESP_STATUS_NO_SUPPORTED_IDP           = "urn:oasis:names:tc:SAML:2.0:status:NoSupportedIDP"
	RESP_STATUS_PARTIAL_LOGOUT             = "urn:oasis:names:tc:SAML:2.0:status:PartialLogout"
	RESP_STATUS_PROXY_COUNT_EXCEEDED       = "urn:oasis:names:tc:SAML:2.0:status:ProxyCountExceeded"
	RESP_STATUS_REQUEST_DENIED             = "urn:oasis:names:tc:SAML:2.0:status:RequestDenied"
	RESP_STATUS_REQUEST_UNSUPPORTED        = "urn:oasis:names:tc:SAML:2.0:status:RequestUnsupported"
	RESP_STATUS_REQUEST_VERSION_DEPRECATED = "urn:oasis:names:tc:SAML:2.0:status:RequestVersionDeprecated"
	RESP_STATUS_REQUEST_VERSION_TOO_HIGH   = "urn:oasis:names:tc:SAML:2.0:status:RequestVersionTooHigh"
	RESP_STATUS_REQUEST_VERSION_TOO_LOW    = "urn:oasis:names:tc:SAML:2.0:status:RequestVersionTooLow"
	RESP_STATUS_RESOURCE_NOT_RECOGNIZED    = "urn:oasis:names:tc:SAML:2.0:status:ResourceNotRecognized"
	RESP_STATUS_TOO_MANY_RESPONSES         = "urn:oasis:names:tc:SAML:2.0:status:TooManyResponses"
	RESP_STATUS_UNKNOWN_ATTR_PROFILE       = "urn:oasis:names:tc:SAML:2.0:status:UnknownAttrProfile"
	RESP_STATUS_UNKNOWN_PRINCIPAL          = "urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal"
	RESP_STATUS_UNSUPPORTED_BINDING        = "urn:oasis:names:tc:SAML:2.0:status:UnsupportedBinding"
)
View Source
const (
	SAML_BINDING_HTTP_POST = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
)

Variables

View Source
var (
	ERR_RESP_UNSUPPORT_VERSION = errors.New("Unsupport saml version!")
	ERR_RESP_NEED_ID           = errors.New("Missing ID attribute on SAML Response")
	ERR_RESP_NEED_ASSERTION    = errors.New("Need Assertions!")
	ERR_RESP_NEED_SIGNATURE    = errors.New("Need signature!")
	ERR_RESP_DEST_MISMATH      = errors.New("Destination mismath!")
	ERR_RESP_METHOD_WRONG      = errors.New("Wrong assertion method!")
	ERR_RESP_RECIP_MISMATH     = errors.New("Subject recipient mismatch!")
	ERR_RESP_ASSERTION_EXPIRED = errors.New("Assertion has expired!")
)

Functions

func GetAuthnRequestURL

func GetAuthnRequestURL(baseURL string, b64XML string, state string) (string, error)

GetAuthnRequestURL generate a URL for the AuthnRequest to the IdP with the SAMLRequst parameter encoded

func ID

func ID() string

ID generate a new V4 UUID

func SignRequest

func SignRequest(xml string, privateKeyPath string) (string, error)

SignRequest sign a SAML 2.0 AuthnRequest `privateKeyPath` must be a path on the filesystem, xmlsec1 is run out of process through `exec`

func SignResponse

func SignResponse(xml string, privateKeyPath string) (string, error)

SignResponse sign a SAML 2.0 Response `privateKeyPath` must be a path on the filesystem, xmlsec1 is run out of process through `exec`

func VerifyRequestSignature

func VerifyRequestSignature(xml string, publicCertPath string) error

VerifyRequestSignature verify signature of a SAML 2.0 AuthnRequest document `publicCertPath` must be a path on the filesystem, xmlsec1 is run out of process through `exec`

func VerifyResponseSignature

func VerifyResponseSignature(xml string, publicCertPath string) error

VerifyResponseSignature verify signature of a SAML 2.0 Response document `publicCertPath` must be a path on the filesystem, xmlsec1 is run out of process through `exec`

Types

type Assertion

type Assertion struct {
	XMLName            xml.Name
	ID                 string `xml:"ID,attr"`
	Version            string `xml:"Version,attr"`
	XS                 string `xml:"xmlns:xs,attr"`
	XSI                string `xml:"xmlns:xsi,attr"`
	IssueInstant       string `xml:"IssueInstant,attr"`
	Issuer             Issuer `xml:"Issuer"`
	Subject            Subject
	Conditions         Conditions
	AuthnStatement     AuthnStatement
	AttributeStatement AttributeStatement
	Signature          *Signature `xml:"ds:Signature,omitempty"`
}

SAML response assertion

type AssertionConsumerService

type AssertionConsumerService struct {
	XMLName  xml.Name
	Binding  string `xml:"Binding,attr"`
	Location string `xml:"Location,attr"`
	Index    string `xml:"index,attr"`
}

type Attribute

type Attribute struct {
	XMLName         xml.Name
	Name            string           `xml:",attr"`
	FriendlyName    string           `xml:",attr,omitempty"`
	NameFormat      string           `xml:",attr,omitempty"`
	AttributeValues []AttributeValue `xml:"AttributeValue"`
}

type AttributeStatement

type AttributeStatement struct {
	XMLName    xml.Name
	Attributes []Attribute `xml:"Attribute"`
}

type AttributeValue

type AttributeValue struct {
	XMLName xml.Name
	Type    string `xml:"xsi:type,attr"`
	Value   string `xml:",innerxml"`
}

type AudienceRestriction

type AudienceRestriction struct {
	Audience string `xml:"saml:Audience"`
}

type AuthnContext

type AuthnContext struct {
	ClassRef string `xml:"saml:AuthnContextClassRef"`
}

type AuthnContextClassRef

type AuthnContextClassRef struct {
	XMLName   xml.Name
	SAML      string `xml:"xmlns:saml,attr"`
	Transport string `xml:",innerxml"`
}

type AuthnRequest

type AuthnRequest struct {
	XMLName                        xml.Name
	SAMLP                          string                `xml:"xmlns:samlp,attr"`
	SAML                           string                `xml:"xmlns:saml,attr"`
	SAMLSIG                        string                `xml:"xmlns:samlsig,attr,omitempty"`
	ID                             string                `xml:"ID,attr"`
	Version                        string                `xml:"Version,attr"`
	ProtocolBinding                string                `xml:"ProtocolBinding,attr"`
	AssertionConsumerServiceURL    string                `xml:"AssertionConsumerServiceURL,attr"`
	IssueInstant                   string                `xml:"IssueInstant,attr"`
	AssertionConsumerServiceIndex  int                   `xml:"AssertionConsumerServiceIndex,attr"`
	AttributeConsumingServiceIndex int                   `xml:"AttributeConsumingServiceIndex,attr"`
	Issuer                         Issuer                `xml:"Issuer"`
	NameIDPolicy                   NameIDPolicy          `xml:"NameIDPolicy,omitempty"`
	RequestedAuthnContext          RequestedAuthnContext `xml:"RequestedAuthnContext"`
	Signature                      *Signature            `xml:"Signature,omitempty"`
	Subject                        Subject               `xml:"Subject,omitempty"`
	Conditions                     Conditions            `xml:"Conditions,omitempty"`
	Scoping                        Scoping               `xml:"Scoping,omitempty"`
	// contains filtered or unexported fields
}

An AuthnRequest is generated by SP(Service Provider) and send to IdP(Identity Provider) Refer: http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf [Page 36, 48]

Attributes and Sequences

Name							Type			Description
ID								ID				required; An identifier for the request.
Version							string			required; The version of the request.
IssueInstant					dateTime		required; The time instant of issue of the request.
Destination						anyURI			optional; A URI reference indicating the address to which this request has been sent.
Consent							anyURI			optional; Indicates whether or not consent has been obtained from a principal.
ForceAuthn						boolean			optional; Indicate IdP MUST authenticate directly or not.
IsPassive						boolean			optional; IdP can take control of the user interface or not.
ProtocolBinding					anyURI			optional; A URI reference that indetifies RESPONSE protocol binding.
AssertionConsumerServiceIndex	uint			optional; Indirectly identifies the location to which the <Response> message should be returned to the requester.
AssertionConsumerServiceURL		anyURI			optional; Specifies by value the location to which the <Response> message MUST be returned to the requester.
AttributeConsumingServiceIndex	uint			optional; Indirectly identifies the SAML attributes to be supplied by the identity provider
ProviderName					string			optional; Specifies the human-readable name of the requester for use by the presenter's user agent or the identity provider.
Issuer							Issuer			optional; Identifies the entity that generated the request message.
Signature						Signature		optional; An XML Signature that authenticates the requester and provides message integrity.
Subject							Subject			optional; Specifies the requested subject of the resulting assertion(s).
Conditions						Conditions		optional; Specifies the SAML conditions the requester expects to limit the validity and/or use of the resulting assertion(s).
Scoping							Scoping			optional; Specifies a set of identity providers trusted by the requester to authenticate the presenter

func NewAuthnRequest

func NewAuthnRequest() *AuthnRequest

func ParseCompressedEncodedRequest

func ParseCompressedEncodedRequest(b64RequestXML string) (*AuthnRequest, error)

func ParseEncodedRequest

func ParseEncodedRequest(b64RequestXML string) (*AuthnRequest, error)

func (*AuthnRequest) CompressedEncodedSignedString

func (r *AuthnRequest) CompressedEncodedSignedString(privateKeyPath string) (string, error)

func (*AuthnRequest) CompressedEncodedString

func (r *AuthnRequest) CompressedEncodedString() (string, error)

func (*AuthnRequest) EncodedSignedString

func (r *AuthnRequest) EncodedSignedString(privateKeyPath string) (string, error)

GetAuthnRequestURL generate a URL for the AuthnRequest to the IdP with the SAMLRequst parameter encoded

func (*AuthnRequest) EncodedString

func (r *AuthnRequest) EncodedString() (string, error)

func (*AuthnRequest) SignedString

func (r *AuthnRequest) SignedString(privateKeyPath string) (string, error)

func (*AuthnRequest) String

func (r *AuthnRequest) String() (string, error)

func (*AuthnRequest) Validate

func (r *AuthnRequest) Validate(publicCertPath string) error

type AuthnStatement

type AuthnStatement struct {
	XMLName             xml.Name
	AuthnInstant        string       `xml:",attr"`
	SessionNotOnOrAfter string       `xml:",attr"`
	SessionIndex        string       `xml:",attr"`
	Context             AuthnContext `xml:"saml:AuthnContext"`
}

type CanonicalizationMethod

type CanonicalizationMethod struct {
	XMLName   xml.Name
	Algorithm string `xml:"Algorithm,attr"`
}

type Conditions

type Conditions struct {
	XMLName             xml.Name
	NotBefore           string              `xml:",attr"`
	NotOnOrAfter        string              `xml:",attr"`
	AudienceRestriction AudienceRestriction `xml:"saml:AudienceRestriction"`
}

type DigestMethod

type DigestMethod struct {
	XMLName   xml.Name
	Algorithm string `xml:"Algorithm,attr"`
}

type DigestValue

type DigestValue struct {
	XMLName xml.Name
}

type EntityAttributes

type EntityAttributes struct {
	XMLName xml.Name
	SAML    string `xml:"xmlns:saml,attr"`
	// should be array??
	EntityAttributes []Attribute `xml:"Attribute"`
}

type EntityDescriptor

type EntityDescriptor struct {
	XMLName  xml.Name
	DS       string `xml:"xmlns:ds,attr"`
	XMLNS    string `xml:"xmlns,attr"`
	MD       string `xml:"xmlns:md,attr"`
	EntityId string `xml:"entityID,attr"`

	Extensions      Extensions      `xml:"Extensions"`
	SPSSODescriptor SPSSODescriptor `xml:"SPSSODescriptor"`
}

type Extensions

type Extensions struct {
	XMLName xml.Name
	Alg     string `xml:"xmlns:alg,attr"`
	MDAttr  string `xml:"xmlns:mdattr,attr"`
	MDRPI   string `xml:"xmlns:mdrpi,attr"`

	EntityAttributes string `xml:"EntityAttributes"`
}

type IDPList

type IDPList struct {
}

type IdentityProviderSettings

type IdentityProviderSettings struct {
}

type Issuer

type Issuer struct {
	XMLName xml.Name
	Format  string `xml:"xmlns:saml,attr,omitempty"`
	Url     string `xml:",innerxml"`
}

func NewIssuer

func NewIssuer(issuer string) *Issuer

NewIssuer will create a new issuer

type KeyDescriptor

type KeyDescriptor struct {
	XMLName xml.Name
	Use     string  `xml:"use,attr"`
	KeyInfo KeyInfo `xml:"KeyInfo"`
}

type KeyInfo

type KeyInfo struct {
	XMLName  xml.Name
	X509Data X509Data `xml:",innerxml"`
}

type NameID

type NameID struct {
	XMLName xml.Name
	Format  string `xml:",attr"`
	Value   string `xml:",innerxml"`
}

type NameIDPolicy

type NameIDPolicy struct {
	XMLName         xml.Name
	SPNameQualifier string `xml:"SPNameQualifier,attr,omitempty"`
	AllowCreate     bool   `xml:"AllowCreate,attr,omitempty"`
	Format          string `xml:"Format,attr,omitempty"`
}

func NewNameIDPolicy

func NewNameIDPolicy() *NameIDPolicy

type RequestedAuthnContext

type RequestedAuthnContext struct {
	XMLName              xml.Name
	SAMLP                string               `xml:"xmlns:samlp,attr"`
	Comparison           string               `xml:"Comparison,attr"`
	AuthnContextClassRef AuthnContextClassRef `xml:"AuthnContextClassRef"`
}

type Response

type Response struct {
	XMLName      xml.Name
	SAMLP        string `xml:"xmlns:samlp,attr"`
	SAML         string `xml:"xmlns:saml,attr"`
	Destination  string `xml:"Destination,attr"`
	ID           string `xml:"ID,attr"`
	Version      string `xml:"Version,attr"`
	IssueInstant string `xml:"IssueInstant,attr"`
	InResponseTo string `xml:"InResponseTo,attr"`

	Issuer    Issuer    `xml:"Issuer"`
	Signature Signature `xml:"Signature,omitempty"`
	Status    Status    `xml:"Status"`
	Assertion Assertion `xml:"Assertion"`
	// contains filtered or unexported fields
}

SAML Response structure

func NewSignedResponse

func NewSignedResponse() *Response

NewSignedResponse create a new signed response

func ParseCompressedEncodedResponse

func ParseCompressedEncodedResponse(b64ResponseXML string) (*Response, error)

func ParseEncodedResponse

func ParseEncodedResponse(b64ResponseXML string) (*Response, error)

func (*Response) AddAttribute

func (r *Response) AddAttribute(name, value string)

AddAttribute add strong attribute to the Response

func (*Response) CompressedEncodedSignedString

func (r *Response) CompressedEncodedSignedString(privateKeyPath string) (string, error)

func (*Response) EncodedSignedString

func (r *Response) EncodedSignedString(privateKeyPath string) (string, error)

func (*Response) GetAttributeValue

func (r *Response) GetAttributeValue(name string) string

GetAttributeValue by Name or by FriendlyName. Return blank string if not found

func (*Response) GetAttributeValues

func (r *Response) GetAttributeValues(name string) []string

GetAttributeValues returns attribute's values

func (*Response) SetIssuer

func (r *Response) SetIssuer(issuer string)

set response issuer(IdP)

func (*Response) SetNameID

func (r *Response) SetNameID(nameID string)

set assertion NameID

func (*Response) SetResponseTo

func (r *Response) SetResponseTo(responseTo string)

set repsonse to

func (*Response) SignedString

func (r *Response) SignedString(privateKeyPath string) (string, error)

func (*Response) String

func (r *Response) String() (string, error)

func (*Response) Validate

func (r *Response) Validate(s *ServiceProviderSettings) error

type SPSSODescriptor

type SPSSODescriptor struct {
	XMLName                    xml.Name
	ProtocolSupportEnumeration string `xml:"protocolSupportEnumeration,attr"`
	SigningKeyDescriptor       KeyDescriptor
	EncryptionKeyDescriptor    KeyDescriptor
	// SingleLogoutService        SingleLogoutService `xml:"SingleLogoutService"`
	AssertionConsumerServices []AssertionConsumerService
}

type SPSSODescriptors

type SPSSODescriptors struct {
}

type SamlsigReference

type SamlsigReference struct {
	XMLName      xml.Name
	URI          string       `xml:"URI,attr"`
	Transforms   Transforms   `xml:",innerxml"`
	DigestMethod DigestMethod `xml:",innerxml"`
	DigestValue  DigestValue  `xml:",innerxml"`
}

type Scoping

type Scoping struct {
	ProxyCount  int      `xml:"ProxyCount,omitempty"`
	IDPList     IDPList  `xml:"IDPList,omitempty"`
	RequesterID []string `xml:"RequesterID"`
}

type ServiceProviderSettings

type ServiceProviderSettings struct {
	PublicCertPath              string
	PrivateKeyPath              string
	IDPSSOURL                   string
	IDPSSODescriptorURL         string
	IDPPublicCertPath           string
	AssertionConsumerServiceURL string
	SPSignRequest               bool
	// contains filtered or unexported fields
}

ServiceProviderSettings provides settings to configure server acting as a SAML Service Provider. Expect only one IDP per SP in this configuration. If you need to configure multipe IDPs for an SP then configure multiple instances of this module

func (*ServiceProviderSettings) GetAuthnRequest

func (s *ServiceProviderSettings) GetAuthnRequest() *AuthnRequest

GetSignedAuthnRequest returns a singed XML document that represents a AuthnRequest SAML document

func (*ServiceProviderSettings) GetEntityDescriptor

func (s *ServiceProviderSettings) GetEntityDescriptor() (string, error)

func (*ServiceProviderSettings) IDPPublicCert

func (s *ServiceProviderSettings) IDPPublicCert() string

func (*ServiceProviderSettings) Init

func (s *ServiceProviderSettings) Init() (err error)

func (*ServiceProviderSettings) PrivateKey

func (s *ServiceProviderSettings) PrivateKey() string

func (*ServiceProviderSettings) PublicCert

func (s *ServiceProviderSettings) PublicCert() string

type Signature

type Signature struct {
	XMLName        xml.Name
	SAMLSIG        string `xml:"xmlns:ds,attr"`
	SignedInfo     SignedInfo
	SignatureValue SignatureValue
	KeyInfo        KeyInfo
}

func NewSignature

func NewSignature() *Signature

type SignatureMethod

type SignatureMethod struct {
	XMLName   xml.Name
	Algorithm string `xml:"Algorithm,attr"`
}

type SignatureValue

type SignatureValue struct {
	XMLName xml.Name
	Value   string `xml:",innerxml"`
}

type SignedInfo

type SignedInfo struct {
	XMLName                xml.Name
	CanonicalizationMethod CanonicalizationMethod
	SignatureMethod        SignatureMethod
	SamlsigReference       SamlsigReference
}

func NewSignedInfo

func NewSignedInfo() *SignedInfo

type SingleLogoutService

type SingleLogoutService struct {
	Binding  string `xml:"Binding,attr"`
	Location string `xml:"Location,attr"`
}

type Status

type Status struct {
	XMLName    xml.Name
	StatusCode StatusCode `xml:"StatusCode"`
}

type StatusCode

type StatusCode struct {
	XMLName xml.Name
	Value   string `xml:",attr"`
}

type Subject

type Subject struct {
	XMLName             xml.Name
	NameID              NameID
	SubjectConfirmation SubjectConfirmation
}

structure of <Subject>

type SubjectConfirmation

type SubjectConfirmation struct {
	XMLName                 xml.Name
	Method                  string `xml:",attr"`
	SubjectConfirmationData SubjectConfirmationData
}

structure of <Subject>

type SubjectConfirmationData

type SubjectConfirmationData struct {
	XMLName      xml.Name
	InResponseTo string `xml:",attr,omitempty"`
	NotOnOrAfter string `xml:",attr,omitempty"`
	NotBefore    string `xml:",attr,omitempty"`
	Recipient    string `xml:",attr,omitempty"`
	Address      string `xml:",attr,omitempty"`
}

It specifies additional data that allows the subject to be confirmed or constrains the circumstances under which the act of subject confirmation can take place

type Transform

type Transform struct {
	XMLName   xml.Name
	Algorithm string `xml:"Algorithm,attr"`
}

type Transforms

type Transforms struct {
	XMLName   xml.Name
	Transform []Transform
}

type X509Certificate

type X509Certificate struct {
	XMLName xml.Name
	Cert    string `xml:",innerxml"`
}

type X509Data

type X509Data struct {
	XMLName         xml.Name
	X509Certificate X509Certificate `xml:",innerxml"`
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL