saml

package
v1.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 23, 2026 License: MIT, MIT Imports: 17 Imported by: 0

Documentation

Overview

Package saml implements SAML 2.0 Service Provider functionality for enterprise SSO.

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrMalformedResponse   = errors.New("sso saml: malformed response XML")
	ErrStatusNotSuccess    = errors.New("sso saml: response status was not success")
	ErrNoAssertion         = errors.New("sso saml: response contains no assertions")
	ErrExpiredAssertion    = errors.New("sso saml: assertion validity window expired")
	ErrAudienceMismatch    = errors.New("sso saml: audience restriction mismatch")
	ErrSignatureInvalid    = errors.New("sso saml: assertion signature verification failed")
	ErrMissingCertificates = errors.New("sso saml: no trusted certificates configured for provider")
	ErrSubjectNotFound     = errors.New("sso saml: no subject NameID in assertion")
)

Functions

func BuildAuthnRequest 

func BuildAuthnRequest(spEntityID, acsURL, idpSSOURL, relayState string) (redirectURL string, requestID string, err error)

BuildAuthnRequest creates a deflated, base64-encoded SAML AuthnRequest redirect URL.

Types

type Assertion 

type Assertion struct {
	ID                 string             `xml:"ID,attr"`
	IssueInstant       string             `xml:"IssueInstant,attr"`
	Issuer             string             `xml:"Issuer"`
	Subject            Subject            `xml:"Subject"`
	Conditions         Conditions         `xml:"Conditions"`
	AttributeStatement AttributeStatement `xml:"AttributeStatement"`
	Signature          Signature          `xml:"Signature"`
}

type AssertionData 

type AssertionData struct {
	Subject    string
	Issuer     string
	Attributes map[string][]string
}

AssertionData holds extracted and validated claims from a SAML Response.

func ParseAndValidateResponse 

func ParseAndValidateResponse(rawBase64 string, cfg *SAMLConfig, expectedAudience string, now time.Time) (*AssertionData, error)

ParseAndValidateResponse parses, verifies and extracts attributes from a base64 SAMLResponse.

type Attribute 

type Attribute struct {
	Name   string   `xml:"Name,attr"`
	Values []string `xml:"AttributeValue"`
}

type AttributeStatement 

type AttributeStatement struct {
	Attributes []Attribute `xml:"Attribute"`
}

type AudienceRestriction 

type AudienceRestriction struct {
	Audience string `xml:"Audience"`
}

type AuthnRequest 

type AuthnRequest struct {
	XMLName                     xml.Name `xml:"urn:oasis:names:tc:SAML:2.0:protocol AuthnRequest"`
	ID                          string   `xml:"ID,attr"`
	Version                     string   `xml:"Version,attr"`
	IssueInstant                string   `xml:"IssueInstant,attr"`
	Destination                 string   `xml:"Destination,attr,omitempty"`
	AssertionConsumerServiceURL string   `xml:"AssertionConsumerServiceURL,attr"`
	ProtocolBinding             string   `xml:"ProtocolBinding,attr"`
	Issuer                      string   `xml:"urn:oasis:names:tc:SAML:2.0:assertion Issuer"`
	NameIDPolicy                struct {
		Format      string `xml:"Format,attr,omitempty"`
		AllowCreate bool   `xml:"AllowCreate,attr"`
	} `xml:"NameIDPolicy"`
}

AuthnRequest represents an outgoing SAML 2.0 AuthnRequest message.

type Conditions 

type Conditions struct {
	NotBefore           string              `xml:"NotBefore,attr"`
	NotOnOrAfter        string              `xml:"NotOnOrAfter,attr"`
	AudienceRestriction AudienceRestriction `xml:"AudienceRestriction"`
}

type Response 

type Response struct {
	XMLName      xml.Name  `xml:"Response"`
	ID           string    `xml:"ID,attr"`
	Destination  string    `xml:"Destination,attr"`
	InResponseTo string    `xml:"InResponseTo,attr"`
	Status       Status    `xml:"Status"`
	Assertion    Assertion `xml:"Assertion"`
	Signature    Signature `xml:"Signature"`
}

Response models the incoming SAML 2.0 Response XML.

type SAMLConfig 

type SAMLConfig struct {
	EntityID     string   `json:"entity_id"`
	SSOURL       string   `json:"sso_url"`
	SLOURL       string   `json:"slo_url,omitempty"`
	Certificates []string `json:"certificates"`
	NameIDFormat string   `json:"name_id_format,omitempty"`
	SPEntityID   string   `json:"sp_entity_id,omitempty"`
	SPACSURL     string   `json:"sp_acs_url,omitempty"`
	SignRequest  bool     `json:"sign_request,omitempty"`
	ForceAuthn   bool     `json:"force_authn,omitempty"`
}

SAMLConfig contains SAML 2.0 specific parameters.

type Signature 

type Signature struct {
	SignedInfo struct {
		CanonicalizationMethod struct {
			Algorithm string `xml:"Algorithm,attr"`
		} `xml:"CanonicalizationMethod"`
		SignatureMethod struct {
			Algorithm string `xml:"Algorithm,attr"`
		} `xml:"SignatureMethod"`
		Reference struct {
			URI          string `xml:"URI,attr"`
			DigestMethod struct {
				Algorithm string `xml:"Algorithm,attr"`
			} `xml:"DigestMethod"`
			DigestValue string `xml:"DigestValue"`
		} `xml:"Reference"`
	} `xml:"SignedInfo"`
	SignatureValue string `xml:"SignatureValue"`
	KeyInfo        struct {
		X509Data struct {
			X509Certificate string `xml:"X509Certificate"`
		} `xml:"X509Data"`
	} `xml:"KeyInfo"`
}

type Status 

type Status struct {
	StatusCode struct {
		Value string `xml:"Value,attr"`
	} `xml:"StatusCode"`
}

type Subject 

type Subject struct {
	NameID struct {
		Format string `xml:"Format,attr"`
		Value  string `xml:",chardata"`
	} `xml:"NameID"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.