saml

type Config struct {
	// IDPMetadataURL points at the IdP's published SAML metadata
	// document (XML). The Provider fetches this once at startup,
	// caches the certs and endpoints from it, and refreshes
	// periodically (crewjam handles the cache lifecycle). One of
	// IDPMetadataURL OR IDPMetadataXML must be set.
	IDPMetadataURL string

	// IDPMetadataXML is an alternative to IDPMetadataURL when the
	// operator has the metadata file on disk (e.g. air-gapped
	// deployments). Mutually exclusive with IDPMetadataURL.
	IDPMetadataXML string

	// EntityID is the SP's entity identifier — what the IdP knows
	// us by. Conventionally the metadata URL, e.g.
	// "http://192.168.31.239:8088/api/v1/auth/saml/metadata".
	// Required.
	EntityID string

	// ACSURL is the Assertion Consumer Service URL — where the
	// IdP POSTs the signed SAMLResponse. Must match the value the
	// IdP has registered. Required.
	ACSURL string

	// SignOnURL is the IdP's SSO endpoint we redirect users to.
	// When IDPMetadataURL is provided, this is auto-discovered
	// and the operator-provided value (if any) is ignored. Kept
	// as a config field for operators who hand-paste metadata
	// (IDPMetadataXML) and don't want to embed a full bindings
	// section in the XML.
	SignOnURL string

	// UsernameAttribute names the <saml:Attribute> whose value
	// becomes AdminUser.Username. Empty means "use NameID."
	UsernameAttribute string

	// GroupsAttribute names the <saml:Attribute> whose
	// AttributeValue children carry the user's group memberships.
	// Empty disables the groups gate.
	GroupsAttribute string

	// RequiredGroups is the list of groups at least one of which
	// must be present in the user's assertion for login to succeed.
	// Empty disables the gate.
	RequiredGroups []string

	// JITProvision enables Just-In-Time AdminUser row creation on
	// first successful login. Matches the OIDC field semantics.
	JITProvision bool

	// SigningCertPath + SigningKeyPath are PEM paths to the SP's
	// signing certificate + private key. When both are set, the
	// provider signs every outbound AuthnRequest with RSA-SHA256,
	// advertises AuthnRequestsSigned="true" in SP metadata, and
	// includes the public cert in the metadata's KeyDescriptor.
	//
	// Threat closed by signing: an attacker who can MITM the
	// browser→IdP redirect chain (malicious extension, hostile
	// network) cannot tamper with the AuthnRequest's fields
	// (ForceAuthn, AssertionConsumerServiceURL, etc) without
	// invalidating the signature — the IdP's verification rejects
	// the mutated request. Without signing the realistic attack
	// surface is narrow (the HMAC state cookie binds the eventual
	// response back to the same browser, so the attacker can't
	// redirect responses to themselves) but downgrade attacks on
	// the request itself become impossible.
	//
	// Empty values disable signing (D5 in the spec — v1 default
	// for operators who don't want to manage an SP signing key).
	// Production deployments should set them.
	SigningCertPath string
	SigningKeyPath  string

	// ForceAuthn, when true, sets ForceAuthn="true" on every
	// AuthnRequest we emit. Keycloak / Auth0 / Okta will then
	// re-prompt the user for credentials even if their IdP-side SSO
	// cookie is still alive. Without this, clicking "Continue with
	// SAML" after a logout silently re-authenticates against the
	// existing IdP session — which feels like the logout didn't
	// work even though the SP session was properly cleared.
	//
	// This is the v1 pragmatic substitute for proper SAML SLO (which
	// is deferred to v2). Operators who want the silent-reauth UX
	// can flip this off, with the trade-off that logout will only
	// affect the SP session.
	ForceAuthn bool

	// RequireAssertionSigned MUST be true for production deployments.
	// crewjam's default is true; we expose the field to make the
	// invariant visible in config files. Setting false disables S2
	// defense and is rejected by Validate().
	RequireAssertionSigned bool

	// ReplayWindow is the maximum clock skew tolerated on NotBefore /
	// NotOnOrAfter checks, in minutes. Defaults to DefaultReplayWindow.
	ReplayWindow int

	// LegacyPermissiveUsername bypasses the strict username regex
	// the same way the OIDC config field does. Set true ONLY by
	// the legacy cmd/admin code path which has pre-existing
	// AdminUser rows with email-format usernames. cmd/api leaves
	// it false.
	LegacyPermissiveUsername bool
}

type Provider struct {
	// contains filtered or unexported fields
}