Documentation
¶
Overview ¶
Package saml is the SAML 2.0 identity adapter (R-043).
Service-provider-initiated sign-in over the HTTP-Redirect binding, with the response returned over HTTP-POST. Every response must be signed — the Response, the Assertion, or both — by a certificate from the provider's metadata; an unsigned one is refused whatever it says. Sign-ins the provider starts on its own (IdP-initiated) are refused unless an administrator turns them on, because nothing ties such a response to the browser presenting it.
Authentication only (R-044): a verified assertion becomes a Subject, and core decides everything else.
Index ¶
- Constants
- func Info() api.KindInfo
- type Adapter
- func (a *Adapter) Authenticate(ctx context.Context, c api.Credential) (api.Subject, error)
- func (a *Adapter) Begin(ctx context.Context, req api.BeginRequest) (*api.Redirect, error)
- func (a *Adapter) Category() api.Category
- func (a *Adapter) Configure(_ context.Context, raw json.RawMessage) error
- func (a *Adapter) HealthCheck(ctx context.Context) error
- func (a *Adapter) Kind() string
- func (a *Adapter) ServiceMetadata(_ context.Context, e api.Endpoints) (*api.Metadata, error)
- func (a *Adapter) SessionPolicy() api.SessionPolicy
- func (a *Adapter) SupportsPush() bool
- func (a *Adapter) WithHTTPClient(c *http.Client) *Adapter
- type Config
Constants ¶
const ClockSkew = 3 * time.Minute
ClockSkew is how far the provider's clock and Pando's may disagree, in either direction, before an assertion is refused as not yet valid or expired. Three minutes, set once for every provider: the library holds it as a package variable.
const DefaultSessionLifetime = 12 * time.Hour
DefaultSessionLifetime is the session length when the configuration does not say. Without SCIM it is also the revocation window (R-050).
const Kind = "saml"
Kind is the adapter's kind string.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Adapter ¶
type Adapter struct {
// contains filtered or unexported fields
}
Adapter is the SAML identity adapter.
func (*Adapter) Authenticate ¶
Authenticate verifies a SAMLResponse posted to the assertion consumer service: signature, issuer, audience, recipient, destination, validity window and — for a sign-in Pando started — that it answers Pando's request.
func (*Adapter) Begin ¶
Begin builds an AuthnRequest for the HTTP-Redirect binding, with core's state as the RelayState.
func (*Adapter) Configure ¶
Configure validates settings. Metadata given inline is parsed now, so a paste that is not metadata fails at save; metadata by URL is fetched at the first use and HealthCheck, so a provider that is down does not block saving.
func (*Adapter) HealthCheck ¶
HealthCheck makes sure the provider's metadata can be read and names a sign-in address and a signing certificate.
func (*Adapter) ServiceMetadata ¶
ServiceMetadata is Pando's service provider metadata: its entity ID, the assertion consumer service for HTTP-POST, and that assertions must be signed. An administrator gives the provider its URL, or the file.
func (*Adapter) SessionPolicy ¶
func (a *Adapter) SessionPolicy() api.SessionPolicy
SessionPolicy declares this adapter's session behavior (R-047). As for OIDC: expiry-only unless the installation turns SCIM on for the provider, which core then reports as push (R-048, R-050).
func (*Adapter) SupportsPush ¶
SupportsPush is true: the providers this targets provision through SCIM.
type Config ¶
type Config struct {
// One of these: where the provider publishes its metadata, or the
// metadata itself.
MetadataURL string `json:"idp_metadata_url,omitempty"`
MetadataXML string `json:"idp_metadata_xml,omitempty"`
// NameIDFormat asks for a NameID format: unspecified (the default),
// email, persistent or transient. Transient is refused: it changes at
// every sign-in, so it cannot identify anyone.
NameIDFormat string `json:"name_id_format,omitempty"`
// Which attribute carries what. Empty tries the names Okta, Entra, Google,
// Keycloak and Authentik use.
SubjectAttribute string `json:"subject_attribute,omitempty"`
UsernameAttribute string `json:"username_attribute,omitempty"`
EmailAttribute string `json:"email_attribute,omitempty"`
NameAttribute string `json:"name_attribute,omitempty"`
GroupsAttribute string `json:"groups_attribute,omitempty"`
// TrustEmail says the provider's email attribute is controlled by its
// administrators, not by the people signing in. SAML has no
// email_verified, so without this Pando never links an account by email.
TrustEmail bool `json:"trust_email,omitempty"`
// AllowIDPInitiated accepts sign-ins started from the provider's own
// dashboard. Off by default: such a response is not tied to the browser
// that presents it, so it can sign someone in as someone else.
AllowIDPInitiated bool `json:"allow_idp_initiated,omitempty"`
SessionMaxLifetime string `json:"session_max_lifetime,omitempty"`
}
Config is what an administrator sets.
Source Files