Documentation
¶
Index ¶
- Constants
- Variables
- type AssertionReplayCache
- type Config
- type Provider
- func (p *Provider) Begin(w http.ResponseWriter, _ *http.Request, returnTo string) (string, error)
- func (p *Provider) ClearStateCookie(w http.ResponseWriter, _ *http.Request)
- func (p *Provider) Complete(r *http.Request) (*authpkg.ExternalIdentity, error)
- func (p *Provider) CompleteWithReturnTo(r *http.Request) (*authpkg.ExternalIdentity, string, error)
- func (p *Provider) Metadata(w http.ResponseWriter, _ *http.Request) error
- func (p *Provider) Name() string
- type ReplayStore
- type ReplayStoreOption
Constants ¶
const ( // ProviderName is the auth method reported by the SAML redirect provider. ProviderName = "saml" // DefaultGroupsAttribute is the envconfig default for // CAESIUM_AUTH_SAML_GROUPS_ATTRIBUTE. DefaultGroupsAttribute = "groups" DefaultACSPath = "/auth/sso/saml/acs" DefaultMetadataPath = "/auth/sso/saml/metadata" DefaultStateCookieName = "caesium_saml_state" DefaultStateTTL = 10 * time.Minute DefaultMetadataFetchTimeout = 30 * time.Second )
Variables ¶
var ( ErrMissingSAMLResponse = errors.New("saml callback missing response") ErrNoRedirectBinding = errors.New("saml idp metadata does not expose HTTP-Redirect SSO") )
var ( ErrAssertionReplay = errors.New("saml assertion replay detected") ErrMissingAssertionID = errors.New("saml assertion id is required") )
var ( ErrInvalidReturnTo = errors.New("invalid returnTo") ErrInvalidState = errors.New("invalid saml state") )
var ErrInvalidAssertion = errors.New("invalid saml assertion")
Functions ¶
This section is empty.
Types ¶
type AssertionReplayCache ¶
type AssertionReplayCache interface {
Record(ctx context.Context, issuer, assertionID string, expiresAt time.Time) error
}
AssertionReplayCache records assertion IDs accepted by the provider.
type Config ¶
type Config struct {
IDPMetadataURL string
IDPMetadataXML string
IDPMetadataFile string
SPEntityID string
SPCertPath string
SPKeyPath string
ACSURL string
MetadataURL string
PublicBaseURL string
GroupsAttribute string
StateCookieName string
StateTTL time.Duration
CookieSecure bool
CookieSecret []byte
HTTPClient *http.Client
ReplayCache AssertionReplayCache
}
Config configures the SAML redirect provider.
func ConfigFromEnv ¶
func ConfigFromEnv(vars env.Environment) Config
ConfigFromEnv converts Caesium environment config into provider config. The caller must still attach a ReplayCache backed by the catalog DB before constructing the provider.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider implements the Caesium browser redirect authenticator for SAML.
func (*Provider) ClearStateCookie ¶
func (p *Provider) ClearStateCookie(w http.ResponseWriter, _ *http.Request)
ClearStateCookie expires the one-time pre-login state cookie.
func (*Provider) Complete ¶
Complete validates the ACS callback and returns the normalized external identity.
func (*Provider) CompleteWithReturnTo ¶
CompleteWithReturnTo validates the ACS callback and returns the RelayState return destination stored during Begin.
type ReplayStore ¶
type ReplayStore struct {
// contains filtered or unexported fields
}
ReplayStore is a catalog-DB-backed replay cache for SAML assertion IDs.
func NewReplayStore ¶
func NewReplayStore(db *gorm.DB, opts ...ReplayStoreOption) *ReplayStore
NewReplayStore creates a replay cache backed by the given database.
type ReplayStoreOption ¶
type ReplayStoreOption func(*ReplayStore)
ReplayStoreOption customizes replay-store behavior.
func WithReplayNow ¶
func WithReplayNow(now func() time.Time) ReplayStoreOption
WithReplayNow overrides the replay-store clock. Intended for tests.
Source Files