Crate saml_rs

Expand description

A library for doing SAML things, terribly, in rust.

My main aim at the moment is to provide IdP capabilities for the Kanidm project.

#![deny(unsafe_code)] is used everywhere to avoid unsafe code tricks. This is why we’re using rust, after all! 🦀 //! If you would like to help - please log PRs/Issues against terminaloutcomes/saml-rs.

There’s a test application saml_test_server based on tide to allow one to test functionality.

Current progress:

Compiles, most of the time
saml_test_server runs on HTTP and HTTPS, parses Redirect requests as-needed. Doesn’t parse them well… or validate them if they’re signed, but it’s a start!
Parses and … seems to handle SP XML data so we can store a representation of it and match them up later

Next steps:

Support the SAML 2.0 Web Browser SSO (SP Redirect Bind/ IdP POST Response) flow
Sign responses
Support Signed AuthN Redirect Requests

SAML 2.0 Web Browser SSO (SP Redirect Bind/ IdP POST Response) flow

User attempts to access the SP resource (eg https://example.com/application)
User is HTTP 302 redirected to the IdP (that’s us!)
- The URL is provided in the SAML2.0 metadata from the IdP
- There should be two query parameters, SAMLRequest and RelayState details about them are available in SamlQuery
The SSO Service validates the request and responds with a document containing an XHTML form:

NOTE: POSTed assertions MUST be signed

<form method="post" action="https://example.com/SAML2/SSO/POST" ...>
  <input type="hidden" name="SAMLResponse" value="response" />
  <input type="hidden" name="RelayState" value="token" />
etc etc...
<input type="submit" value="Submit" />
</form>

Request the Assertion Consumer Service at the SP. The user agent issues a POST request to the Assertion Consumer Service at the service provider:

POST /SAML2/SSO/POST HTTP/1.1
Host: sp.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: nnn
SAMLResponse=response&RelayState=token

To automate the submission of the form, the following line of JavaScript may appear anywhere on the XHTML page:

window.onload = function () { document.forms[0].submit(); }

Testing tools:

Idp/SP online tester - https://samltest.id/
Parser for requests and responses: https://samltool.io
OneLogin SAMLTool - https://www.samltool.com/validate_xml.php great for validating things against schema.