Documentation
¶
Overview ¶
based on https://github.com/42wim/crewjam-saml
based on https://github.com/RobotsAndPencils/go-saml/metadata.go
based on https://github.com/42wim/crewjam-saml
based on https://github.com/42wim/crewjam-saml Package samlsp provides helpers that can be used to protect web services using SAML.
based on https://github.com/42wim/crewjam-saml
based on https://github.com/RobotsAndPencils/go-saml/types.go
Index ¶
- func NewVaultSource() (*api.Client, error)
- func RequireAttribute(name, value string) func(http.Handler) http.Handler
- func WithToken(ctx context.Context, token *AuthorizationToken) context.Context
- type Assertion
- type AssertionConsumerService
- type Attribute
- type AttributeStatement
- type AttributeValue
- type Attributes
- type Audience
- type AudienceRestriction
- type AuthnContext
- type AuthnContextClassRef
- type AuthnRequest
- type AuthnStatement
- type AuthorizationToken
- type CanonicalizationMethod
- type ClientCookies
- func (c ClientCookies) DeleteSession(w http.ResponseWriter, r *http.Request, id string) error
- func (c ClientCookies) DeleteState(w http.ResponseWriter, r *http.Request, id string) error
- func (c ClientCookies) GetSessions(r *http.Request) map[string]string
- func (c ClientCookies) GetState(r *http.Request, id string) string
- func (c ClientCookies) GetStates(r *http.Request) map[string]string
- func (c ClientCookies) GetToken(r *http.Request) string
- func (c ClientCookies) SetSession(w http.ResponseWriter, r *http.Request, id string, value string)
- func (c ClientCookies) SetState(w http.ResponseWriter, r *http.Request, id string, value string)
- func (c ClientCookies) SetToken(w http.ResponseWriter, r *http.Request, value string, maxAge time.Duration)
- type ClientState
- type ClientToken
- type Conditions
- type DB
- type DigestMethod
- type DigestValue
- type EntityAttributes
- type EntityDescriptor
- type Extensions
- type Issuer
- type KeyDescriptor
- type KeyInfo
- type NameID
- type NameIDPolicy
- type Options
- type RequestedAuthnContext
- type Response
- type SAMLPlugin
- func (s *SAMLPlugin) Authorize(w http.ResponseWriter, r *http.Request, assertion *saml.Assertion)
- func (s *SAMLPlugin) GetAuthorizationToken(r *http.Request) *AuthorizationToken
- func (s *SAMLPlugin) GetEntityDescriptor() (string, error)
- func (s *SAMLPlugin) IsAuthorized(r *http.Request) bool
- func (s *SAMLPlugin) RequireAccount(w http.ResponseWriter, r *http.Request)
- func (s *SAMLPlugin) ServeHTTP(w http.ResponseWriter, r *http.Request) (int, error)
- type SPSSODescriptor
- type SPSSODescriptors
- type SamlsigReference
- type Session
- type Signature
- type SignatureMethod
- type SignatureValue
- type SignedInfo
- type SingleLogoutService
- type Status
- type StatusCode
- type Subject
- type SubjectConfirmation
- type SubjectConfirmationData
- type Transform
- type Transforms
- type VaultSource
- type X509Certificate
- type X509Data
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewVaultSource ¶
func RequireAttribute ¶
RequireAttribute returns a middleware function that requires that the SAML attribute `name` be set to `value`. This can be used to require that a remote user be a member of a group. It relies on the Claims assigned to to the context in RequireAccount.
For example:
goji.Use(m.RequireAccount)
goji.Use(RequireAttributeSAMLPlugin("eduPersonAffiliation", "Staff"))
Types ¶
type Assertion ¶
type Assertion struct {
XMLName xml.Name
ID string `xml:"ID,attr"`
Version string `xml:"Version,attr"`
XS string `xml:"xmlns:xs,attr"`
XSI string `xml:"xmlns:xsi,attr"`
SAML string `xml:"xmlns:saml,attr"`
IssueInstant string `xml:"IssueInstant,attr"`
Issuer Issuer `xml:"Issuer"`
Subject Subject
Conditions Conditions
AuthnStatements []AuthnStatement `xml:"AuthnStatement,omitempty"`
AttributeStatement AttributeStatement
}
type AttributeStatement ¶
type AttributeValue ¶
type Attributes ¶
Attributes is a map of attributes provided in the SAML assertion
func (Attributes) Get ¶
func (a Attributes) Get(key string) string
Get returns the first attribute named `key` or an empty string if no such attributes is present.
func (Attributes) GetAll ¶
func (a Attributes) GetAll(key string) []string
Get returns the first attribute named `key` or an empty string if no such attributes is present.
type AudienceRestriction ¶
type AuthnContext ¶
type AuthnContext struct {
XMLName xml.Name
AuthnContextClassRef AuthnContextClassRef `xml:"AuthnContextClassRef"`
}
type AuthnContextClassRef ¶
type AuthnRequest ¶
type AuthnRequest struct {
XMLName xml.Name
SAMLP string `xml:"xmlns:samlp,attr"`
SAML string `xml:"xmlns:saml,attr"`
SAMLSIG string `xml:"xmlns:samlsig,attr,omitempty"`
ID string `xml:"ID,attr"`
Version string `xml:"Version,attr"`
ProtocolBinding string `xml:"ProtocolBinding,attr"`
AssertionConsumerServiceURL string `xml:"AssertionConsumerServiceURL,attr"`
Destination string `xml:"Destination,attr"`
IssueInstant string `xml:"IssueInstant,attr"`
AssertionConsumerServiceIndex int `xml:"AssertionConsumerServiceIndex,attr"`
AttributeConsumingServiceIndex int `xml:"AttributeConsumingServiceIndex,attr"`
Issuer Issuer `xml:"Issuer"`
NameIDPolicy NameIDPolicy `xml:"NameIDPolicy"`
RequestedAuthnContext RequestedAuthnContext `xml:"RequestedAuthnContext"`
Signature *Signature `xml:"Signature,omitempty"`
// contains filtered or unexported fields
}
type AuthnStatement ¶
type AuthorizationToken ¶
type AuthorizationToken struct {
jwt.StandardClaims
Attributes Attributes `json:"attr"`
}
AuthorizationToken represents the data stored in the authorization cookie.
func Token ¶
func Token(ctx context.Context) *AuthorizationToken
Token returns the token associated with ctx, or nil if no token are associated
type CanonicalizationMethod ¶
type ClientCookies ¶
type ClientCookies struct {
ServiceProvider *saml.ServiceProvider
Name string
Domain string
Secure bool
}
ClientCookies implements ClientState and ClientToken using cookies.
func (ClientCookies) DeleteSession ¶
func (c ClientCookies) DeleteSession(w http.ResponseWriter, r *http.Request, id string) error
DeleteSession removes the named stored state by clearing the corresponding cookie.
func (ClientCookies) DeleteState ¶
func (c ClientCookies) DeleteState(w http.ResponseWriter, r *http.Request, id string) error
DeleteState removes the named stored state by clearing the corresponding cookie.
func (ClientCookies) GetSessions ¶
func (c ClientCookies) GetSessions(r *http.Request) map[string]string
GetSessions returns the currently stored states by reading cookies.
func (ClientCookies) GetState ¶
func (c ClientCookies) GetState(r *http.Request, id string) string
GetState returns a single stored state by reading the cookies
func (ClientCookies) GetStates ¶
func (c ClientCookies) GetStates(r *http.Request) map[string]string
GetStates returns the currently stored states by reading cookies.
func (ClientCookies) GetToken ¶
func (c ClientCookies) GetToken(r *http.Request) string
GetToken returns the token by reading the cookie.
func (ClientCookies) SetSession ¶
func (c ClientCookies) SetSession(w http.ResponseWriter, r *http.Request, id string, value string)
func (ClientCookies) SetState ¶
func (c ClientCookies) SetState(w http.ResponseWriter, r *http.Request, id string, value string)
SetState stores the named state value by setting a cookie.
func (ClientCookies) SetToken ¶
func (c ClientCookies) SetToken(w http.ResponseWriter, r *http.Request, value string, maxAge time.Duration)
SetToken assigns the specified token by setting a cookie.
type ClientState ¶
type ClientState interface {
SetState(w http.ResponseWriter, r *http.Request, id string, value string)
GetStates(r *http.Request) map[string]string
GetState(r *http.Request, id string) string
DeleteState(w http.ResponseWriter, r *http.Request, id string) error
SetSession(w http.ResponseWriter, r *http.Request, id string, value string)
GetSessions(r *http.Request) map[string]string
DeleteSession(w http.ResponseWriter, r *http.Request, id string) error
}
ClientState implements client side storage for state.
type ClientToken ¶
type ClientToken interface {
GetToken(r *http.Request) string
SetToken(w http.ResponseWriter, r *http.Request, value string, maxAge time.Duration)
}
ClientToken implements client side storage for signed authorization tokens.
type Conditions ¶
type Conditions struct {
XMLName xml.Name
NotBefore string `xml:",attr"`
NotOnOrAfter string `xml:",attr"`
AudienceRestrictions []AudienceRestriction `xml:"AudienceRestriction,omitempty"`
}
type DigestMethod ¶
type DigestValue ¶
type EntityAttributes ¶
type EntityDescriptor ¶
type EntityDescriptor struct {
XMLName xml.Name
DS string `xml:"xmlns:ds,attr"`
XMLNS string `xml:"xmlns,attr"`
MD string `xml:"xmlns:md,attr"`
EntityId string `xml:"entityID,attr"`
Extensions Extensions `xml:"Extensions"`
SPSSODescriptor SPSSODescriptor `xml:"SPSSODescriptor"`
}
type Extensions ¶
type KeyDescriptor ¶
type NameIDPolicy ¶
type Options ¶
type Options struct {
URL url.URL
Key *rsa.PrivateKey
Logger logger.Interface
Certificate *x509.Certificate
AllowIDPInitiated bool
IDPMetadata *saml.EntityDescriptor
IDPMetadataURL *url.URL
HTTPClient *http.Client
CookieMaxAge time.Duration
CookieSecure bool
ForceAuthn bool
CookieName string
EnableSessions bool
DbURI string
}
Options represents the parameters for creating a new middleware
type RequestedAuthnContext ¶
type RequestedAuthnContext struct {
XMLName xml.Name
SAMLP string `xml:"xmlns:samlp,attr"`
Comparison string `xml:"Comparison,attr"`
AuthnContextClassRef AuthnContextClassRef `xml:"AuthnContextClassRef"`
}
type Response ¶
type Response struct {
XMLName xml.Name
SAMLP string `xml:"xmlns:samlp,attr"`
SAML string `xml:"xmlns:saml,attr"`
SAMLSIG string `xml:"xmlns:samlsig,attr"`
Destination string `xml:"Destination,attr"`
ID string `xml:"ID,attr"`
Version string `xml:"Version,attr"`
IssueInstant string `xml:"IssueInstant,attr"`
InResponseTo string `xml:"InResponseTo,attr"`
Issuer Issuer `xml:"Issuer"`
Signature Signature `xml:"Signature"`
Status Status `xml:"Status"`
Assertion Assertion `xml:"Assertion"`
// contains filtered or unexported fields
}
type SAMLPlugin ¶
type SAMLPlugin struct {
ServiceProvider saml.ServiceProvider
AllowIDPInitiated bool
TokenMaxAge time.Duration
ClientState ClientState
ClientToken ClientToken
EnableSessions bool
Map map[string][]string
Db *DB
// contains filtered or unexported fields
}
SAMLPlugin implements middleware than allows a web application to support SAML.
It implements http.Handler so that it can provide the metadata and ACS endpoints, typically /saml/metadata and /saml/acs, respectively.
It also provides middleware RequireAccount which redirects users to the auth process if they do not have session credentials.
When redirecting the user through the SAML auth flow, the middlware assigns a temporary cookie with a random name beginning with "saml_". The value of the cookie is a signed JSON Web Token containing the original URL requested and the SAML request ID. The random part of the name corresponds to the RelayState parameter passed through the SAML flow.
When validating the SAML response, the RelayState is used to look up the correct cookie, validate that the SAML request ID, and redirect the user back to their original URL.
Sessions are established by issuing a JSON Web Token (JWT) as a session cookie once the SAML flow has succeeded. The JWT token contains the authenticated attributes from the SAML assertion.
When the middlware receives a request with a valid session JWT it extracts the SAML attributes and modifies the http.Request object adding a Context object to the request context that contains attributes from the initial SAML assertion.
When issuing JSON Web Tokens, a signing key is required. Because the SAML service provider already has a private key, we borrow that key to sign the JWTs as well.
func (*SAMLPlugin) Authorize ¶
func (s *SAMLPlugin) Authorize(w http.ResponseWriter, r *http.Request, assertion *saml.Assertion)
Authorize is invoked by ServeHTTP when we have a new, valid SAML assertion. It sets a cookie that contains a signed JWT containing the assertion attributes. It then redirects the user's browser to the original URL contained in RelayState.
func (*SAMLPlugin) GetAuthorizationToken ¶
func (s *SAMLPlugin) GetAuthorizationToken(r *http.Request) *AuthorizationToken
GetAuthorizationToken is invoked by RequireAccount to determine if the request is already authorized or if the user's browser should be redirected to the SAML login flow. If the request is authorized, then the request context is ammended with a Context object.
func (*SAMLPlugin) GetEntityDescriptor ¶
func (s *SAMLPlugin) GetEntityDescriptor() (string, error)
func (*SAMLPlugin) IsAuthorized ¶
func (s *SAMLPlugin) IsAuthorized(r *http.Request) bool
IsAuthorized returns true if the request has already been authorized.
Note: This function is retained for compatability. Use GetAuthorizationToken in new code instead.
func (*SAMLPlugin) RequireAccount ¶
func (s *SAMLPlugin) RequireAccount(w http.ResponseWriter, r *http.Request)
RequireAccount is HTTP middleware that requires that each request be associated with a valid session. If the request is not associated with a valid session, then rather than serve the request, the middlware redirects the user to start the SAML auth flow.
func (*SAMLPlugin) ServeHTTP ¶
func (s *SAMLPlugin) ServeHTTP(w http.ResponseWriter, r *http.Request) (int, error)
ServeHTTP implements http.Handler and serves the SAML-specific HTTP endpoints on the URIs specified by m.ServiceProvider.MetadataURL and m.ServiceProvider.AcsURL.
type SPSSODescriptor ¶
type SPSSODescriptor struct {
XMLName xml.Name
ProtocolSupportEnumeration string `xml:"protocolSupportEnumeration,attr"`
SigningKeyDescriptor KeyDescriptor
EncryptionKeyDescriptor KeyDescriptor
SingleLogoutService SingleLogoutService `xml:"SingleLogoutService"`
AuthnRequestsSigned bool `xml:",attr"`
WantAssertionsSigned bool `xml:",attr"`
AssertionConsumerServices []AssertionConsumerService
}
type SPSSODescriptors ¶
type SPSSODescriptors struct {
}
type SamlsigReference ¶
type SamlsigReference struct {
XMLName xml.Name
URI string `xml:"URI,attr"`
Transforms Transforms `xml:",innerxml"`
DigestMethod DigestMethod `xml:",innerxml"`
DigestValue DigestValue `xml:",innerxml"`
}
type Signature ¶
type Signature struct {
XMLName xml.Name
Id string `xml:"Id,attr"`
SignedInfo SignedInfo
SignatureValue SignatureValue
KeyInfo KeyInfo
}
type SignatureMethod ¶
type SignatureValue ¶
type SignedInfo ¶
type SignedInfo struct {
XMLName xml.Name
CanonicalizationMethod CanonicalizationMethod
SignatureMethod SignatureMethod
SamlsigReference SamlsigReference
}
type SingleLogoutService ¶
type Status ¶
type Status struct {
XMLName xml.Name
StatusCode StatusCode `xml:"StatusCode"`
}
type StatusCode ¶
type Subject ¶
type Subject struct {
XMLName xml.Name
NameID NameID
SubjectConfirmation SubjectConfirmation
}
type SubjectConfirmation ¶
type SubjectConfirmation struct {
XMLName xml.Name
Method string `xml:",attr"`
SubjectConfirmationData SubjectConfirmationData
}
type SubjectConfirmationData ¶
type Transforms ¶
type VaultSource ¶
type X509Certificate ¶
type X509Data ¶
type X509Data struct {
XMLName xml.Name
X509Certificate X509Certificate `xml:",innerxml"`
}