saml

package
v1.21.13 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 18, 2026 License: Apache-2.0 Imports: 22 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func GetAttributeValue 

func GetAttributeValue(assertion *saml.Assertion, attributeName string) string

GetAttributeValue safely retrieves an attribute value from the assertion SEM@0dcfe60d024e5cd95a40b61fc489253e670af6ce: fetch the first value for a named attribute from a SAML assertion (pure)

func GetAttributeValues 

func GetAttributeValues(assertion *saml.Assertion, attributeName string) []string

GetAttributeValues safely retrieves all values for an attribute from the assertion SEM@0dcfe60d024e5cd95a40b61fc489253e670af6ce: fetch all values for a named attribute from a SAML assertion (pure)

Types

type AttributeNames 

type AttributeNames struct {
	Email      string
	Name       string
	GivenName  string
	FamilyName string
	Groups     string
	UID        string
}

AttributeNames defines standard SAML attribute names SEM@0dcfe60d024e5cd95a40b61fc489253e670af6ce: set of standard SAML claim attribute names for user profile fields

func DefaultAttributeNames 

func DefaultAttributeNames() AttributeNames

DefaultAttributeNames returns common SAML attribute names SEM@0dcfe60d024e5cd95a40b61fc489253e670af6ce: return WS-Federation schema SAML attribute names for common profile claims (pure)

func OktaAttributeNames 

func OktaAttributeNames() AttributeNames

OktaAttributeNames returns Okta-specific SAML attribute names SEM@0dcfe60d024e5cd95a40b61fc489253e670af6ce: return Okta-specific SAML attribute names for common profile claims (pure)

type IDTokenClaims 

type IDTokenClaims struct {
	Subject       string
	Email         string
	EmailVerified bool
	Name          string
}

IDTokenClaims represents claims from an ID token (stub for interface compatibility) SEM@2fbab585a899780eb5d718ec784b7c730c732113: stub ID token claims struct for SAML interface compatibility (pure)

type SAMLConfig 

type SAMLConfig struct {
	// Basic configuration
	ID      string `json:"id" yaml:"id"`           // Provider ID (e.g., "saml_okta")
	Name    string `json:"name" yaml:"name"`       // Display name
	Enabled bool   `json:"enabled" yaml:"enabled"` // Whether this provider is enabled
	Icon    string `json:"icon" yaml:"icon"`       // Icon identifier

	// SAML-specific configuration
	EntityID          string `json:"entity_id" yaml:"entity_id"`                     // Service Provider entity ID
	ACSURL            string `json:"acs_url" yaml:"acs_url"`                         // Assertion Consumer Service URL
	SLOURL            string `json:"slo_url" yaml:"slo_url"`                         // Single Logout URL
	IDPMetadataURL    string `json:"idp_metadata_url" yaml:"idp_metadata_url"`       // IdP metadata URL (fetched at startup)
	IDPMetadataB64XML string `json:"idp_metadata_b64xml" yaml:"idp_metadata_b64xml"` // Base64-encoded IdP metadata XML
	SPPrivateKeyPath  string `json:"sp_private_key_path" yaml:"sp_private_key_path"` // SP private key file path
	SPCertificatePath string `json:"sp_certificate_path" yaml:"sp_certificate_path"` // SP certificate file path
	SPPrivateKey      string `json:"sp_private_key" yaml:"sp_private_key"`           // SP private key (PEM)
	SPCertificate     string `json:"sp_certificate" yaml:"sp_certificate"`           // SP certificate (PEM)
	AllowIDPInitiated bool   `json:"allow_idp_initiated" yaml:"allow_idp_initiated"` // Allow IdP-initiated SSO
	ForceAuthn        bool   `json:"force_authn" yaml:"force_authn"`                 // Force reauthentication
	SignRequests      bool   `json:"sign_requests" yaml:"sign_requests"`             // Sign AuthnRequests
	EncryptAssertions bool   `json:"encrypt_assertions" yaml:"encrypt_assertions"`   // Require encrypted assertions

	// Attribute mapping
	AttributeMapping map[string]string `json:"attribute_mapping" yaml:"attribute_mapping"`

	// Group configuration
	GroupAttributeName string `json:"group_attribute_name" yaml:"group_attribute_name"` // SAML attribute containing groups
	GroupPrefix        string `json:"group_prefix" yaml:"group_prefix"`                 // Optional prefix filter for groups
}

SAMLConfig represents the configuration for a SAML identity provider SEM@7e40aae7f066b1d045faeff914884107bde40f0e: full configuration for a SAML identity provider including SP keys and attribute mapping

type SAMLProvider 

type SAMLProvider struct {
	// contains filtered or unexported fields
}

SAMLProvider implements the Provider interface for SAML authentication SEM@0dcfe60d024e5cd95a40b61fc489253e670af6ce: SAML service provider holding config, SP descriptor, and IdP metadata (pure)

func NewSAMLProvider 

func NewSAMLProvider(config *SAMLConfig) (*SAMLProvider, error)

NewSAMLProvider creates a new SAML provider SEM@d90c40114705e5560d91377af5101409dd78f88e: build and configure a SAMLProvider from SP key/cert and fetched IdP metadata

func (*SAMLProvider) CreateMiddleware 

func (p *SAMLProvider) CreateMiddleware(opts samlsp.Options) (*samlsp.Middleware, error)

CreateMiddleware creates SAML middleware for HTTP handlers SEM@85ed60a219cd0aba38e90907408068f8235d4cc1: build a SAML SP middleware from provider config and IdP metadata

func (*SAMLProvider) ExchangeCode 

func (p *SAMLProvider) ExchangeCode(ctx context.Context, code string) (*TokenResponse, error)

ExchangeCode is not applicable for SAML SEM@2fbab585a899780eb5d718ec784b7c730c732113: return an error; SAML does not support authorization code exchange (pure)

func (*SAMLProvider) ExtractUserInfoFromAssertion 

func (p *SAMLProvider) ExtractUserInfoFromAssertion(assertion *saml.Assertion) (*UserInfo, error)

ExtractUserInfoFromAssertion extracts user info from a SAML assertion SEM@2fbab585a899780eb5d718ec784b7c730c732113: parse user identity attributes from a verified SAML assertion (pure)

func (*SAMLProvider) GenerateMetadata 

func (p *SAMLProvider) GenerateMetadata() (string, error)

GenerateMetadata returns the SP metadata XML string SEM@2fbab585a899780eb5d718ec784b7c730c732113: return the SP metadata as an XML string (pure)

func (*SAMLProvider) GetAuthorizationURL 

func (p *SAMLProvider) GetAuthorizationURL(state string) (string, error)

GetAuthorizationURL generates a SAML authentication request URL SEM@85ed60a219cd0aba38e90907408068f8235d4cc1: build a SAML HTTP-redirect SSO URL with relay state for the configured IdP (pure)

func (*SAMLProvider) GetAuthorizationURLForceAuthn 

func (p *SAMLProvider) GetAuthorizationURLForceAuthn(state string) (string, error)

GetAuthorizationURLForceAuthn generates a SAML authentication request URL with ForceAuthn=true set on the AuthnRequest, overriding the configured p.config.ForceAuthn default. Used by /oauth2/step_up (#397) to require a fresh interactive re-authentication at the IdP. SEM@e55d63794c48585aafab36880122df63ab8ab1be: build a SAML SSO URL with ForceAuthn to require fresh IdP authentication (pure)

func (*SAMLProvider) GetConfig 

func (p *SAMLProvider) GetConfig() *SAMLConfig

GetConfig returns the SAML configuration SEM@0dcfe60d024e5cd95a40b61fc489253e670af6ce: return the SAML provider configuration (pure)

func (*SAMLProvider) GetMetadata 

func (p *SAMLProvider) GetMetadata() (*saml.EntityDescriptor, error)

GetMetadata returns the service provider metadata SEM@0dcfe60d024e5cd95a40b61fc489253e670af6ce: return the SP EntityDescriptor metadata struct (pure)

func (*SAMLProvider) GetMetadataXML 

func (p *SAMLProvider) GetMetadataXML() ([]byte, error)

GetMetadataXML returns the service provider metadata as XML SEM@0dcfe60d024e5cd95a40b61fc489253e670af6ce: serialize the SP metadata to indented XML bytes (pure)

func (*SAMLProvider) GetOAuth2Config 

func (p *SAMLProvider) GetOAuth2Config() *oauth2.Config

GetOAuth2Config returns nil as SAML doesn't use OAuth2 SEM@0dcfe60d024e5cd95a40b61fc489253e670af6ce: return nil to satisfy the provider interface; SAML does not use OAuth2 (pure)

func (*SAMLProvider) GetUserInfo 

func (p *SAMLProvider) GetUserInfo(ctx context.Context, accessToken string) (*UserInfo, error)

GetUserInfo is not applicable for SAML (user info comes from assertion) SEM@2fbab585a899780eb5d718ec784b7c730c732113: return an error; SAML user info is extracted from the assertion, not via token (pure)

func (*SAMLProvider) InitiateLogin 

func (p *SAMLProvider) InitiateLogin(clientCallback *string) (string, string, error)

InitiateLogin creates a SAML authentication request SEM@2fbab585a899780eb5d718ec784b7c730c732113: generate a SAML authentication URL and relay state for a new login flow (pure)

func (*SAMLProvider) MakeLogoutResponse 

func (p *SAMLProvider) MakeLogoutResponse(inResponseTo string, status string) (string, error)

MakeLogoutResponse creates a SAML logout response SEM@f4f52c4150b0113a1db8646f6327c385ab0ec2b1: build and base64-encode a SAML logout response for the IdP (pure)

func (*SAMLProvider) ParseResponse 

func (p *SAMLProvider) ParseResponse(samlResponse string) (*saml.Assertion, error)

ParseResponse parses and validates a SAML response with full signature verification SEM@3cfa5ca8e2e34a45e99f3137a0eb102176a82bc4: decode and validate a base64 SAML response, returning a verified assertion (pure)

func (*SAMLProvider) ProcessLogoutRequest 

func (p *SAMLProvider) ProcessLogoutRequest(samlRequest string) (*saml.LogoutRequest, error)

ProcessLogoutRequest handles a SAML logout request from the IdP.

Binding note: this accepts the HTTP-POST binding form of the request -- base64-encoded LogoutRequest XML carrying an enveloped XML signature. The HTTP-Redirect binding carries a DEFLATE-compressed payload whose signature lives in the SigAlg/Signature query parameters rather than inside the XML; that form is not supported by this method and is rejected (it fails XML parsing, or signature validation if inflated XML without an embedded signature is supplied).

SECURITY: the request is only trusted after its enveloped XML signature has been verified against the IdP signing certificate(s) from metadata. Unsigned requests are rejected outright. SEM@bbf626f42894b3914617abadecf11fccd86a73b1: validate signature and fields of a base64 SAML logout request from the IdP (pure)

func (*SAMLProvider) ValidateIDToken 

func (p *SAMLProvider) ValidateIDToken(ctx context.Context, idToken string) (*IDTokenClaims, error)

ValidateIDToken is not applicable for SAML SEM@2fbab585a899780eb5d718ec784b7c730c732113: return an error; SAML does not issue ID tokens (pure)

type TokenResponse 

type TokenResponse struct {
	AccessToken  string
	RefreshToken string
	IDToken      string
	ExpiresIn    int
}

TokenResponse represents the tokens returned by SAML (stub for interface compatibility) SEM@2fbab585a899780eb5d718ec784b7c730c732113: stub token response struct for SAML interface compatibility (pure)

type UserInfo 

type UserInfo struct {
	ID            string
	IDType        string // Type of identifier: "subject-id", "pairwise-id", "nameid"
	Email         string
	EmailVerified bool
	// EmailSynthesized is true when Email was fabricated by a fallback, not asserted by the IdP.
	EmailSynthesized bool
	Name             string
	// NameSynthesized is true when Name was fabricated by a fallback, not asserted by the IdP.
	NameSynthesized bool
	GivenName       string
	FamilyName      string
	Picture         string
	Locale          string
	IdP             string
	Groups          []string
}

UserInfo represents user information extracted from SAML assertion SEM@78155d54490599e00095eb72b817575bb1e8da5b: user identity fields extracted from a SAML assertion (pure)

func ExtractUserInfo 

func ExtractUserInfo(assertion *saml.Assertion, config *SAMLConfig) (*UserInfo, error)

ExtractUserInfo extracts user information and groups from SAML assertion SEM@6c25e3ec7f7ed25ea5f9e345de5a65c91aec4567: parse a SAML assertion into a UserInfo struct applying all attribute mappings and fallbacks

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.