samladapter

type Config struct {
	// ConfigurationID is the host-chosen UUIDv7 under which credbound
	// indexes this provider and its linked identities. Required.
	ConfigurationID credbound.UUID
	// MetadataXML is the IdP metadata document (an EntityDescriptor, or an
	// EntitiesDescriptor containing one IdP role). Static metadata is the
	// primary, recommended path: it is parsed eagerly so misconfiguration
	// surfaces at construction, and it never makes the adapter reach out to
	// the network. Exactly one of MetadataXML and MetadataURL must be set.
	MetadataXML []byte
	// MetadataURL is fetched lazily on first use and then re-fetched every
	// MetadataRefreshInterval, with a 10-second timeout and an SSRF-hardened
	// fetch: HTTPS only, every address the host resolves to must be publicly
	// routable, redirects are refused, and the connection is pinned to a
	// vetted address so a DNS rebind between resolution and dial cannot
	// steer the fetch into an internal network. Loopback hosts named
	// literally in the URL (localhost, 127.0.0.1, ::1) are exempt for
	// development and may also use plain HTTP. A failed refresh keeps
	// serving the last good metadata. Prefer MetadataXML; use MetadataURL
	// when the IdP rotates certificates too often to redeploy with fresh
	// static metadata.
	MetadataURL string
	// MetadataRefreshInterval bounds how long a fetched MetadataURL document is
	// cached before it is re-fetched, so a rotated or revoked IdP signing
	// certificate is picked up without a redeploy. Zero uses a default of 12
	// hours. Ignored for static MetadataXML.
	MetadataRefreshInterval time.Duration
	// SPEntityID is this service provider's entity ID: the value the IdP
	// must put in the assertion's AudienceRestriction and the Issuer of the
	// AuthnRequests the adapter emits. Required.
	SPEntityID string
	// ACSURL is the host's assertion consumer service URL — the endpoint
	// whose handler forwards the posted response to credbound's FinishSSO.
	// The assertion's Destination and SubjectConfirmation Recipient must
	// match it. Required. HTTPS is mandatory except for loopback hosts.
	ACSURL string
	// Certificate is the SP signing certificate, paired with Key. Optional;
	// when both are set, HTTP-Redirect AuthnRequests are signed (SigAlg and
	// Signature query parameters, SHA-256). Set both or neither.
	Certificate *x509.Certificate
	// Key is the SP signing key: an *rsa.PrivateKey or *ecdsa.PrivateKey.
	Key crypto.Signer
	// AllowTransientNameID accepts transient-format NameIDs as the subject.
	// Off by default because a transient NameID changes per ceremony and
	// therefore cannot key a durable credbound SSO identity; enable it only
	// for IdPs that mislabel stable identifiers as transient.
	AllowTransientNameID bool
	// TrustAssertedEmail forwards the asserted email attribute to credbound as
	// verified. Off by default: SAML carries no email_verified equivalent, so
	// an IdP that lets a subject influence its outbound attributes (self-service
	// profiles, loosely-mapped directories, guest accounts) could otherwise
	// assert someone else's address and drive JIT provisioning to squat it.
	// Enable it only for an IdP whose email attribute is authoritative for the
	// subject. When off, the email is dropped and credbound keys the identity
	// on issuer and subject alone.
	TrustAssertedEmail bool
	// HTTPClient is used only for the one-shot MetadataURL fetch. Defaults
	// to a client with a 10-second timeout; a supplied client without a
	// timeout is shallow-copied and given the default. The Resolver vetting
	// and the redirect refusal apply to supplied clients too, but the
	// connection pinning that defeats DNS rebinding requires the default
	// client: a host that supplies its own transport takes over that part
	// of the SSRF posture.
	HTTPClient *http.Client
	// Resolver vets MetadataURL hosts before dialing: every address the
	// host resolves to must be publicly routable, or the fetch is refused.
	// Defaults to net.DefaultResolver. Override it only in tests.
	Resolver Resolver
	// Clock supplies the current time for the adapter's own re-validation of
	// assertion conditions. Defaults to time.Now. Note that crewjam/saml
	// validates its timestamps with its package-level saml.TimeNow, which
	// this per-provider clock does not replace.
	Clock func() time.Time
}

type Provider struct {
	// contains filtered or unexported fields
}

type Resolver interface {
	LookupIPAddr(context.Context, string) ([]net.IPAddr, error)
}