samlidp

type AssertionIssuer interface {
	// ParseAuthnRequest decodes a SAML AuthnRequest (the already
	// base64/inflate-decoded XML bytes) and returns its echoed subset.
	// relayState is the transport-level RelayState to carry through.
	ParseAuthnRequest(raw []byte, relayState string) (AuthnRequestInfo, error)
	// Issue mints a signed SAML Response asserting subject for sp, echoing
	// req. It returns ErrUnknownServiceProvider when req.Issuer disagrees
	// with sp.EntityID.
	Issue(ctx context.Context, sp ServiceProvider, subject Subject, req AuthnRequestInfo) (Response, error)
}

type AuthnRequestInfo struct {
	// ID is the AuthnRequest @ID, echoed as Response @InResponseTo.
	ID string
	// Issuer is the SP entityID that sent the request.
	Issuer string
	// ACSURL is the AssertionConsumerServiceURL the SP requested, if any.
	// Empty falls back to the registered SP's ACSURL.
	ACSURL string
	// RelayState is the opaque value the SP supplied; the IdP echoes it
	// back unmodified on completion. Carried alongside (not inside) the
	// request envelope.
	RelayState string
}

type Issuer interface {
	MetadataProvider
	AssertionIssuer
	// Name reports the active implementation (ProviderNoop | ProviderRSA).
	Name() string
	// Enabled reports whether real issuance is possible. The no-op Issuer
	// returns false; the HTTP surface mounts nothing when false.
	Enabled() bool
}

type MetadataProvider interface {
	// EntityID returns the IdP's SAML entityID (its metadata URL by
	// convention).
	EntityID() string
	// Metadata returns the IdP EntityDescriptor XML advertising the SSO
	// endpoint(s) and the signing certificate.
	Metadata() ([]byte, error)
}

type NoopIssuer struct{}

type Options struct {
	EntityID string
	SSOURL   string
	SLOURL   string
	KeyPEM   []byte
	CertPEM  []byte
}

type RSAIssuer struct {
	// contains filtered or unexported fields
}

type Response struct {
	// XML is the complete, signed <samlp:Response> document (UTF-8).
	XML []byte
	// ACSURL is where XML must be delivered (HTTP-POST binding).
	ACSURL string
	// RelayState echoes the SP-supplied RelayState (may be empty).
	RelayState string
}

type ServiceProvider struct {
	// EntityID is the SP's SAML entityID (the Issuer it puts on its
	// AuthnRequest and the default Audience of the assertion).
	EntityID string
	// ACSURL is the SP Assertion Consumer Service endpoint the signed
	// SAML Response is delivered to (HTTP-POST binding). Required.
	ACSURL string
	// Audience overrides the AudienceRestriction value. Empty means use
	// EntityID.
	Audience string
	// NameIDFormat overrides the assertion Subject NameID Format. Empty
	// means urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress.
	NameIDFormat string
}

type Subject struct {
	// NameID is the Subject identifier (required). For the default
	// emailAddress format this is the user's email.
	NameID string
	// Attributes are extra single-valued SAML attributes keyed by name.
	Attributes map[string]string
}