saml

package module

Go to main page

Versions in this module

v0

v0.6.1

Nov 7, 2026 GO-2026-6909

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

Changes in this version

+ var ErrNoAttributeService = errors.New(...)

+ var MaxArtifactResponseSize int64 = 10 << 20

+ var MaxAttributeQueryResponseSize int64 = 10 << 20

+ func VerifyMetadataSignature(data []byte, certs []*x509.Certificate) ([]byte, error)

+ type AttributeQuery struct

+ Attributes []Attribute

+ Consent string

+ Destination string

+ ID string

+ IssueInstant time.Time

+ Issuer *Issuer

+ Signature *etree.Element

+ Subject *Subject

+ Version string

+ XMLName xml.Name

+ func (r *AttributeQuery) Element() *etree.Element

+ func (r *AttributeQuery) MarshalXML(e *xml.Encoder, _ xml.StartElement) error

+ func (r *AttributeQuery) SoapRequest() *etree.Element

+ func (r *AttributeQuery) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ type AttributeQueryResult struct

+ Assertions []Assertion

+ Attributes []Attribute

type IdentityProvider

+ LogoutBindings []string

+ func (idp *IdentityProvider) ServeSLO(w http.ResponseWriter, r *http.Request)

+ type IdpLogoutRequest struct

+ Binding string

+ HTTPRequest *http.Request

+ IDP *IdentityProvider

+ Now time.Time

+ RelayState string

+ Request LogoutRequest

+ RequestBuffer []byte

+ SLOEndpoint *Endpoint

+ ServiceProviderMetadata *EntityDescriptor

+ func NewIdpLogoutRequest(idp *IdentityProvider, r *http.Request) (*IdpLogoutRequest, error)

+ func (req *IdpLogoutRequest) MakeLogoutResponse(statusCode string) *LogoutResponse

+ func (req *IdpLogoutRequest) MatchesSession(session *Session) bool

+ func (req *IdpLogoutRequest) Validate() error

+ func (req *IdpLogoutRequest) WriteLogoutResponse(w http.ResponseWriter, resp *LogoutResponse) error

type ServiceProvider

+ AuthnContextClassRefComparator func(comparison string, requested []string, got string) bool

+ func (sp *ServiceProvider) GetAttributeServiceLocation(binding string) string

+ func (sp *ServiceProvider) MakeAttributeQuery(nameID NameID, attributes ...Attribute) (*AttributeQuery, error)

+ func (sp *ServiceProvider) ParseXMLAttributeQueryResponse(soapResponseXML []byte, query *AttributeQuery) (*AttributeQueryResult, error)

+ func (sp *ServiceProvider) QueryAttributes(ctx context.Context, nameID NameID, attributes ...Attribute) (*AttributeQueryResult, error)

+ func (sp *ServiceProvider) SignAttributeQuery(req *AttributeQuery) error

+ type SessionInvalidator interface

+ InvalidateSession func(w http.ResponseWriter, r *http.Request, req *IdpLogoutRequest) error

v0.6.0

Nov 7, 2026 GO-2026-6909

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

Changes in this version

+ const AlgSupportNamespace

+ const HTTPPostSimpleSignBinding

+ const ShibbolethMetadataNamespace

+ var ErrArtifactResolution = errors.New("saml: artifact resolution failed")

+ var ErrAssertionReplayed = errors.New("assertion has already been used")

+ var ErrAudienceMismatch = errors.New("saml: audience restriction does not match this service provider")

+ var ErrAuthnContextMismatch = errors.New("saml: authentication context does not match the requested one")

+ var ErrCertificateNotValidNow = errors.New("saml: signing certificate is expired or not yet valid")

+ var ErrDecryptionFailed = errors.New("saml: cannot decrypt")

+ var ErrDestinationMismatch = errors.New("saml: destination does not match the recipient")

+ var ErrExpired = errors.New("saml: expired")

+ var ErrInvalidCertificate = errors.New("saml: invalid certificate")

+ var ErrInvalidSignature = errors.New("saml: invalid signature")

+ var ErrIssuerMismatch = errors.New("saml: issuer does not match the IdP metadata")

+ var ErrMalformedMessage = errors.New("saml: malformed message")

+ var ErrMissingElement = errors.New("saml: required element is missing")

+ var ErrNotYetValid = errors.New("saml: not yet valid")

+ var ErrRequestIDMismatch = errors.New("saml: InResponseTo does not match a request ID")

+ var ErrUnknownAssertionConsumerService = errors.New("saml: unknown assertion consumer service")

+ var ErrUnknownServiceProvider = errors.New("saml: unknown service provider")

+ var ErrUnsupported = errors.New("saml: not supported")

+ var ErrUntrustedCertificate = errors.New("saml: signing certificate is not trusted")

type AffiliationDescriptor

+ Extensions *Extensions

+ func (m *AffiliationDescriptor) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ func (m AffiliationDescriptor) MarshalXML(e *xml.Encoder, start xml.StartElement) error

type Assertion

+ func (a *Assertion) MarshalXML(e *xml.Encoder, _ xml.StartElement) error

+ type AssertionReplayCache interface

+ Consume func(assertionID string, expiresAt time.Time) error

type AttributeAuthorityDescriptor

+ func (m *AttributeAuthorityDescriptor) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ func (m AttributeAuthorityDescriptor) MarshalXML(e *xml.Encoder, start xml.StartElement) error

type AudienceRestriction

+ AdditionalAudiences []Audience

+ func (a *AudienceRestriction) AllAudiences() []Audience

+ func (a *AudienceRestriction) MarshalXML(e *xml.Encoder, start xml.StartElement) error

+ func (a *AudienceRestriction) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ type AuthenticatingAuthority struct

+ Value string

+ func (a *AuthenticatingAuthority) Element() *etree.Element

type AuthnAuthorityDescriptor

+ func (m *AuthnAuthorityDescriptor) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ func (m AuthnAuthorityDescriptor) MarshalXML(e *xml.Encoder, start xml.StartElement) error

type AuthnContext

+ AuthenticatingAuthorities []AuthenticatingAuthority

type AuthnRequest

+ Scoping *Scoping

+ func (r *AuthnRequest) PostWithNonce(relayState, nonce string) []byte

+ func (r *AuthnRequest) SimpleSign(relayState string, sp *ServiceProvider) ([]byte, error)

+ func (r *AuthnRequest) SimpleSignWithNonce(relayState, nonce string, sp *ServiceProvider) ([]byte, error)

+ type DefaultResponseWriter struct

+ func (DefaultResponseWriter) WriteResponse(w http.ResponseWriter, req *IdpAuthnRequest) error

+ type DigestMethod struct

+ Algorithm string

+ XMLName xml.Name

type EncryptionMethod

+ KeySize *int

type EntitiesDescriptor

+ Extensions *Extensions

type EntityDescriptor

+ Extensions *Extensions

+ type ExtensionElement struct

+ Attrs []xml.Attr

+ CharData string

+ Children []ExtensionElement

+ XMLName xml.Name

+ func (m *ExtensionElement) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ type Extensions struct

+ DigestMethods []DigestMethod

+ Other []ExtensionElement

+ ShibbolethScopes []ShibbolethScope

+ SigningMethods []SigningMethod

+ XMLName xml.Name

+ type IDPEntry struct

+ Loc string

+ Name string

+ ProviderID string

+ XMLName xml.Name

+ func (a *IDPEntry) Element() *etree.Element

+ type IDPList struct

+ GetComplete string

+ IDPEntries []IDPEntry

+ XMLName xml.Name

+ func (a *IDPList) Element() *etree.Element

type IDPSSODescriptor

+ func (m *IDPSSODescriptor) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ func (m IDPSSODescriptor) MarshalXML(e *xml.Encoder, _ xml.StartElement) error

type IdentityProvider

+ AdvertiseSimpleSignSSO bool

+ AssertionEncrypter xmlenc.Encrypter

+ ExtraCertificates []*x509.Certificate

+ MetadataScopes []ShibbolethScope

+ NameIDFormats []NameIDFormat

+ OnError func(w http.ResponseWriter, r *http.Request, status int, err error)

+ ResponseWriter ResponseWriter

+ SignMetadata bool

+ SimpleSignResponseFormTemplate *template.Template

+ func (idp *IdentityProvider) DefaultOnError(w http.ResponseWriter, _ *http.Request, status int, err error)

+ func (idp *IdentityProvider) NewIdpInitiatedRequest(r *http.Request, serviceProviderID string, relayState string) (*IdpAuthnRequest, error)

+ func (idp *IdentityProvider) SignedMetadata() (*etree.Element, error)

type IdpAuthnRequest

+ func (req *IdpAuthnRequest) SimpleSignBinding() (IdpAuthnRequestSimpleSignForm, error)

+ type IdpAuthnRequestSimpleSignForm struct

+ RelayState string

+ SAMLResponse string

+ SigAlg string

+ Signature string

+ URL string

type InvalidResponseError

+ func (ivr *InvalidResponseError) Unwrap() error

type LogoutRequest

+ func (r *LogoutRequest) PostWithNonce(relayState, nonce string) []byte

+ func (r *LogoutRequest) SimpleSign(relayState string, sp *ServiceProvider) ([]byte, error)

+ func (r *LogoutRequest) SimpleSignWithNonce(relayState, nonce string, sp *ServiceProvider) ([]byte, error)

+ type LogoutRequestOption func(*LogoutRequest)

+ func WithSessionIndex(sessionIndex string) LogoutRequestOption

type LogoutResponse

+ func (r *LogoutResponse) PostWithNonce(relayState, nonce string) []byte

+ func (r *LogoutResponse) SimpleSign(relayState string, sp *ServiceProvider) ([]byte, error)

+ func (r *LogoutResponse) SimpleSignWithNonce(relayState, nonce string, sp *ServiceProvider) ([]byte, error)

type PDPDescriptor

+ func (m *PDPDescriptor) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ func (m PDPDescriptor) MarshalXML(e *xml.Encoder, start xml.StartElement) error

type RequestedAuthnContext

+ AuthnContextClassRefs []string

+ func (r *RequestedAuthnContext) ClassRefs() []string

+ func (r *RequestedAuthnContext) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ func (r RequestedAuthnContext) MarshalXML(e *xml.Encoder, start xml.StartElement) error

+ type ResponseWriter interface

+ WriteResponse func(w http.ResponseWriter, req *IdpAuthnRequest) error

type RoleDescriptor

+ Extensions *Extensions

type SPSSODescriptor

+ func (m *SPSSODescriptor) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ func (m SPSSODescriptor) MarshalXML(e *xml.Encoder, _ xml.StartElement) error

+ type Scoping struct

+ IDPList *IDPList

+ ProxyCount *int

+ RequesterIDs []string

+ XMLName xml.Name

+ func (a *Scoping) Element() *etree.Element

type ServiceProvider

+ AcsIndex *int

+ AssertionConsumerServiceBindings []string

+ Clock *dsig.Clock

+ DecryptionKeys []*rsa.PrivateKey

+ EncryptionCertificate *x509.Certificate

+ EncryptionKey *rsa.PrivateKey

+ IgnoreCertificateExpiry bool

+ MetadataOmitValidUntil bool

+ ReplayCache AssertionReplayCache

+ Scoping *Scoping

+ SignMetadata bool

+ ValidateAuthnContextClassRef bool

+ func (sp *ServiceProvider) MakeSimpleSignAuthenticationRequest(relayState string) ([]byte, error)

+ func (sp *ServiceProvider) MakeSimpleSignLogoutRequest(nameID, relayState string, opts ...LogoutRequestOption) ([]byte, error)

+ func (sp *ServiceProvider) MakeSimpleSignLogoutResponse(logoutRequestID, relayState string) ([]byte, error)

+ func (sp *ServiceProvider) ParseLogoutResponse(req *http.Request, possibleRequestIDs []string) (*LogoutResponse, error)

+ func (sp *ServiceProvider) RedirectLogoutRequestURL(req *LogoutRequest, relayState string) (*url.URL, error)

+ func (sp *ServiceProvider) SignedMetadata() (*etree.Element, error)

+ func (sp *ServiceProvider) ValidateLogoutRequest(req *http.Request) (*LogoutRequest, error)

+ func (sp *ServiceProvider) ValidateLogoutRequestForm(postFormData string) (*LogoutRequest, error)

+ type ShibbolethScope struct

+ Regexp bool

+ Value string

+ XMLName xml.Name

+ type SigningMethod struct

+ Algorithm string

+ MaxKeySize int

+ MinKeySize int

+ XMLName xml.Name

type StatusDetail

+ func (sm *StatusDetail) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ func (sm StatusDetail) MarshalXML(e *xml.Encoder, start xml.StartElement) error

v0.5.2

Nov 6, 2026 GO-2026-6909

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

v0.5.1

Apr 14, 2025 GO-2026-6909

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

v0.5.0

Apr 12, 2025 GO-2026-6909

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

Changes in this version

type EntitiesDescriptor

+ func (m *EntitiesDescriptor) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ func (m EntitiesDescriptor) MarshalXML(e *xml.Encoder, _ xml.StartElement) error

type IdentityProvider

+ LoginURL url.URL

+ ResponseFormTemplate *template.Template

type ServiceProvider

+ IDPCertificate *string

+ IDPCertificateFingerprint *string

+ IDPCertificateFingerprintAlgorithm *string

+ ValidateAudienceRestriction func(assertion *Assertion) error

+ ValidateRequestID func(response Response, possibleRequestIDs []string) error

type Session

+ EduPersonPrincipalName string

v0.4.14

Oct 14, 2023 GO-2026-6909

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

Changes in this version

+ const SOAPBindingV1

type Endpoint

+ func (m *Endpoint) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

type IdentityProvider

+ Signer crypto.Signer

type IndexedEndpoint

+ func (m *IndexedEndpoint) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

v0.4.13

Mar 22, 2023 GO-2023-2114 +1 more

GO-2023-2114: Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

v0.4.12

Jan 14, 2023 GO-2023-1664 +2 more

GO-2023-1664: Denial of service via deflate compression bomb in github.com/crewjam/saml

GO-2023-2114: Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

v0.4.11

Jan 12, 2023 GO-2023-1664 +2 more

GO-2023-1664: Denial of service via deflate compression bomb in github.com/crewjam/saml

GO-2023-2114: Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

Changes in this version

type IdpAuthnRequest

+ func (req *IdpAuthnRequest) PostBinding() (IdpAuthnRequestForm, error)

+ type IdpAuthnRequestForm struct

+ RelayState string

+ SAMLResponse string

+ URL string

type Session

+ NameIDFormat string

+ SubjectID string

v0.4.10

Nov 28, 2022 GO-2023-1664 +2 more

GO-2023-1664: Denial of service via deflate compression bomb in github.com/crewjam/saml

GO-2023-2114: Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

v0.4.9

Nov 28, 2022 GO-2023-1664 +2 more

GO-2023-1664: Denial of service via deflate compression bomb in github.com/crewjam/saml

GO-2023-2114: Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

v0.4.8

Jun 25, 2022 GO-2022-1129 +3 more

GO-2022-1129: Authentication bypass in github.com/crewjam/saml

GO-2023-1664: Denial of service via deflate compression bomb in github.com/crewjam/saml

GO-2023-2114: Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

v0.4.7

Jun 25, 2022 GO-2022-1129 +3 more

GO-2022-1129: Authentication bypass in github.com/crewjam/saml

GO-2023-1664: Denial of service via deflate compression bomb in github.com/crewjam/saml

GO-2023-2114: Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

Changes in this version

type AuthnRequest

+ RequestedAuthnContext *RequestedAuthnContext

+ type RequestedAuthnContext struct

+ AuthnContextClassRef string

+ Comparison string

+ XMLName xml.Name

+ func (r *RequestedAuthnContext) Element() *etree.Element

type ServiceProvider

+ HTTPClient *http.Client

+ LogoutBindings []string

+ RequestedAuthnContext *RequestedAuthnContext

v0.4.6

Dec 10, 2021 GO-2022-1129 +3 more

GO-2022-1129: Authentication bypass in github.com/crewjam/saml

GO-2023-1664: Denial of service via deflate compression bomb in github.com/crewjam/saml

GO-2023-2114: Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

Changes in this version

+ const HTTPArtifactBinding

+ const SOAPBinding

+ func GetSigningContext(sp *ServiceProvider) (*dsig.SigningContext, error)

+ type ArtifactResolve struct

+ Artifact string

+ ID string

+ IssueInstant time.Time

+ Issuer *Issuer

+ Signature *etree.Element

+ Version string

+ XMLName xml.Name

+ func (r *ArtifactResolve) Element() *etree.Element

+ func (r *ArtifactResolve) MarshalXML(e *xml.Encoder, start xml.StartElement) error

+ func (r *ArtifactResolve) SoapRequest() *etree.Element

+ func (r *ArtifactResolve) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ type ArtifactResponse struct

+ ID string

+ InResponseTo string

+ IssueInstant time.Time

+ Issuer *Issuer

+ Response Response

+ Signature *etree.Element

+ Status Status

+ Version string

+ XMLName xml.Name

+ func (r *ArtifactResponse) Element() *etree.Element

+ func (r *ArtifactResponse) MarshalXML(e *xml.Encoder, start xml.StartElement) error

+ func (r *ArtifactResponse) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

type IDPSSODescriptor

+ ArtifactResolutionServices []Endpoint

type KeyInfo

+ X509Data X509Data

type LogoutRequest

+ NotOnOrAfter *time.Time

type ServiceProvider

+ DefaultRedirectURI string

+ func (sp *ServiceProvider) GetArtifactBindingLocation(binding string) string

+ func (sp *ServiceProvider) MakeArtifactResolveRequest(artifactID string) (*ArtifactResolve, error)

+ func (sp *ServiceProvider) ParseXMLArtifactResponse(decodedResponseXML []byte, possibleRequestIDs []string, ...) (*Assertion, error)

+ func (sp *ServiceProvider) SignArtifactResolve(req *ArtifactResolve) error

type StatusMessage

+ XMLName xml.Name

+ type X509Certificate struct

+ Data string

+ XMLName xml.Name

+ type X509Data struct

+ X509Certificates []X509Certificate

+ XMLName xml.Name

v0.4.5

Dec 14, 2020 GO-2022-1129 +3 more

GO-2022-1129: Authentication bypass in github.com/crewjam/saml

GO-2023-1664: Denial of service via deflate compression bomb in github.com/crewjam/saml

GO-2023-2114: Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

Changes in this version

type LogoutResponse

+ func (resp *LogoutResponse) Post(relayState string) []byte

+ func (resp *LogoutResponse) Redirect(relayState string) *url.URL

type ServiceProvider

+ func (sp *ServiceProvider) MakeLogoutResponse(idpURL, logoutRequestID string) (*LogoutResponse, error)

+ func (sp *ServiceProvider) MakePostLogoutResponse(logoutRequestID, relayState string) ([]byte, error)

+ func (sp *ServiceProvider) MakeRedirectLogoutResponse(logoutRequestID, relayState string) (*url.URL, error)

+ func (sp *ServiceProvider) SignLogoutRequest(req *LogoutRequest) error

+ func (sp *ServiceProvider) SignLogoutResponse(resp *LogoutResponse) error

type Session

+ CustomAttributes []Attribute

v0.4.4

Dec 14, 2020 GO-2022-1129 +3 more

GO-2022-1129: Authentication bypass in github.com/crewjam/saml

GO-2023-1664: Denial of service via deflate compression bomb in github.com/crewjam/saml

GO-2023-2114: Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

v0.4.3

Dec 14, 2020 GO-2022-1129 +3 more

GO-2022-1129: Authentication bypass in github.com/crewjam/saml

GO-2023-1664: Denial of service via deflate compression bomb in github.com/crewjam/saml

GO-2023-2114: Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

v0.4.2

Sep 29, 2020 GO-2021-0058 +4 more

GO-2021-0058: Signature validation bypass due to XML processing error in github.com/crewjam/saml

GO-2022-1129: Authentication bypass in github.com/crewjam/saml

GO-2023-1664: Denial of service via deflate compression bomb in github.com/crewjam/saml

GO-2023-2114: Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

v0.4.1

Aug 12, 2020 GO-2021-0058 +4 more

GO-2021-0058: Signature validation bypass due to XML processing error in github.com/crewjam/saml

GO-2022-1129: Authentication bypass in github.com/crewjam/saml

GO-2023-1664: Denial of service via deflate compression bomb in github.com/crewjam/saml

GO-2023-2114: Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

Changes in this version

type LogoutRequest

+ func (req *LogoutRequest) Post(relayState string) []byte

+ func (req *LogoutRequest) Redirect(relayState string) *url.URL

type ServiceProvider

+ SignatureMethod string

+ func (sp *ServiceProvider) MakePostLogoutRequest(nameID, relayState string) ([]byte, error)

+ func (sp *ServiceProvider) SignAuthnRequest(req *AuthnRequest) error

v0.4.0

Feb 3, 2020 GO-2021-0058 +4 more

GO-2021-0058: Signature validation bypass due to XML processing error in github.com/crewjam/saml

GO-2022-1129: Authentication bypass in github.com/crewjam/saml

GO-2023-1664: Denial of service via deflate compression bomb in github.com/crewjam/saml

GO-2023-2114: Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

Changes in this version

type LogoutRequest

+ func (r *LogoutRequest) Bytes() ([]byte, error)

+ func (r *LogoutRequest) Deflate() ([]byte, error)

type ServiceProvider

+ EntityID string

+ SignatureVerifier SignatureVerifier

+ func (sp *ServiceProvider) ValidateLogoutResponseForm(postFormData string) error

+ func (sp *ServiceProvider) ValidateLogoutResponseRedirect(queryParameterData string) error

+ func (sp *ServiceProvider) ValidateLogoutResponseRequest(req *http.Request) error

+ type SessionIndex struct

+ Value string

+ func (s *SessionIndex) Element() *etree.Element

+ type SignatureVerifier interface

+ VerifySignature func(validationContext *dsig.ValidationContext, el *etree.Element) error

v0.3.1

Nov 20, 2019 GO-2021-0058 +4 more

GO-2021-0058: Signature validation bypass due to XML processing error in github.com/crewjam/saml

GO-2022-1129: Authentication bypass in github.com/crewjam/saml

GO-2023-1664: Denial of service via deflate compression bomb in github.com/crewjam/saml

GO-2023-2114: Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

Changes in this version

+ type ErrBadStatus struct

+ Status string

+ func (e ErrBadStatus) Error() string

type IdentityProvider

+ ValidDuration *time.Duration

v0.3.0

Oct 31, 2019 GO-2021-0058 +4 more

GO-2021-0058: Signature validation bypass due to XML processing error in github.com/crewjam/saml

GO-2022-1129: Authentication bypass in github.com/crewjam/saml

GO-2023-1664: Denial of service via deflate compression bomb in github.com/crewjam/saml

GO-2023-2114: Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

Changes in this version

+ const DefaultCacheDuration

+ const DefaultValidDuration

+ const StatusAuthnFailed

+ const StatusInvalidAttrNameOrValue

+ const StatusInvalidNameIDPolicy

+ const StatusNoAuthnContext

+ const StatusNoAvailableIDP

+ const StatusNoPassive

+ const StatusNoSupportedIDP

+ const StatusPartialLogout

+ const StatusProxyCountExceeded

+ const StatusRequestDenied

+ const StatusRequestUnsupported

+ const StatusRequestVersionDeprecated

+ const StatusRequestVersionTooHigh

+ const StatusRequestVersionTooLow

+ const StatusRequester

+ const StatusResourceNotRecognized

+ const StatusResponder

+ const StatusTooManyResponses

+ const StatusUnknownAttrProfile

+ const StatusUnknownPrincipal

+ const StatusUnsupportedBinding

+ const StatusVersionMismatch

+ var Clock *dsig.Clock

+ var HTTPPostBinding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

+ var HTTPRedirectBinding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"

+ var MaxClockSkew = time.Second * 180

+ var MaxIssueDelay = time.Second * 90

+ var Metadata = struct{}

+ var RandReader = rand.Reader

+ var StatusSuccess = "urn:oasis:names:tc:SAML:2.0:status:Success"

+ var TimeNow = func() time.Time

+ type AffiliationDescriptor struct

+ AffiliateMembers []string

+ AffiliationOwnerID string

+ CacheDuration time.Duration

+ ID string

+ KeyDescriptors []KeyDescriptor

+ Signature *etree.Element

+ ValidUntil time.Time

+ type Assertion struct

+ AttributeStatements []AttributeStatement

+ AuthnStatements []AuthnStatement

+ Conditions *Conditions

+ ID string

+ IssueInstant time.Time

+ Issuer Issuer

+ Signature *etree.Element

+ Subject *Subject

+ Version string

+ XMLName xml.Name

+ func (a *Assertion) Element() *etree.Element

+ func (a *Assertion) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ type AssertionAttribute struct

+ FriendlyName string

+ Name string

+ Value string

+ type AssertionAttributes []AssertionAttribute

+ func (aa AssertionAttributes) Get(name string) *AssertionAttribute

+ type AssertionMaker interface

+ MakeAssertion func(req *IdpAuthnRequest, session *Session) error

+ type Attribute struct

+ FriendlyName string

+ Name string

+ NameFormat string

+ Values []AttributeValue

+ func (a *Attribute) Element() *etree.Element

+ type AttributeAuthorityDescriptor struct

+ AssertionIDRequestServices []Endpoint

+ AttributeProfiles []string

+ AttributeServices []Endpoint

+ Attributes []Attribute

+ NameIDFormats []NameIDFormat

+ type AttributeConsumingService struct

+ Index int

+ IsDefault *bool

+ RequestedAttributes []RequestedAttribute

+ ServiceDescriptions []LocalizedName

+ ServiceNames []LocalizedName

+ type AttributeStatement struct

+ Attributes []Attribute

+ func (a *AttributeStatement) Element() *etree.Element

+ type AttributeValue struct

+ NameID *NameID

+ Type string

+ Value string

+ func (a *AttributeValue) Element() *etree.Element

+ type Audience struct

+ Value string

+ func (a *Audience) Element() *etree.Element

+ type AudienceRestriction struct

+ Audience Audience

+ func (a *AudienceRestriction) Element() *etree.Element

+ type AuthnAuthorityDescriptor struct

+ AssertionIDRequestServices []Endpoint

+ AuthnQueryServices []Endpoint

+ NameIDFormats []NameIDFormat

+ type AuthnContext struct

+ AuthnContextClassRef *AuthnContextClassRef

+ func (a *AuthnContext) Element() *etree.Element

+ type AuthnContextClassRef struct

+ Value string

+ func (a *AuthnContextClassRef) Element() *etree.Element

+ type AuthnRequest struct

+ AssertionConsumerServiceIndex string

+ AssertionConsumerServiceURL string

+ AttributeConsumingServiceIndex string

+ Conditions *Conditions

+ Consent string

+ Destination string

+ ForceAuthn *bool

+ ID string

+ IsPassive *bool

+ IssueInstant time.Time

+ Issuer *Issuer

+ NameIDPolicy *NameIDPolicy

+ ProtocolBinding string

+ ProviderName string

+ Signature *etree.Element

+ Subject *Subject

+ Version string

+ XMLName xml.Name

+ func (r *AuthnRequest) Element() *etree.Element

+ func (r *AuthnRequest) MarshalXML(e *xml.Encoder, start xml.StartElement) error

+ func (r *AuthnRequest) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ func (req *AuthnRequest) Post(relayState string) []byte

+ func (req *AuthnRequest) Redirect(relayState string) *url.URL

+ type AuthnStatement struct

+ AuthnContext AuthnContext

+ AuthnInstant time.Time

+ SessionIndex string

+ SessionNotOnOrAfter *time.Time

+ SubjectLocality *SubjectLocality

+ func (a *AuthnStatement) Element() *etree.Element

+ func (a *AuthnStatement) MarshalXML(e *xml.Encoder, start xml.StartElement) error

+ func (a *AuthnStatement) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ type Conditions struct

+ AudienceRestrictions []AudienceRestriction

+ NotBefore time.Time

+ NotOnOrAfter time.Time

+ OneTimeUse *OneTimeUse

+ ProxyRestriction *ProxyRestriction

+ func (c *Conditions) Element() *etree.Element

+ func (c *Conditions) MarshalXML(e *xml.Encoder, start xml.StartElement) error

+ func (c *Conditions) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ type ContactPerson struct

+ Company string

+ ContactType string

+ EmailAddresses []string

+ GivenName string

+ SurName string

+ TelephoneNumbers []string

+ type DefaultAssertionMaker struct

+ func (DefaultAssertionMaker) MakeAssertion(req *IdpAuthnRequest, session *Session) error

+ type Duration time.Duration

+ func (d *Duration) UnmarshalText(text []byte) error

+ func (d Duration) MarshalText() ([]byte, error)

+ type EncryptionMethod struct

+ Algorithm string

+ type Endpoint struct

+ Binding string

+ Location string

+ ResponseLocation string

+ type EntitiesDescriptor struct

+ CacheDuration *time.Duration

+ EntitiesDescriptors []EntitiesDescriptor

+ EntityDescriptors []EntityDescriptor

+ ID *string

+ Name *string

+ Signature *etree.Element

+ ValidUntil *time.Time

+ XMLName xml.Name

+ type EntityDescriptor struct

+ AdditionalMetadataLocations []string

+ AffiliationDescriptor *AffiliationDescriptor

+ AttributeAuthorityDescriptors []AttributeAuthorityDescriptor

+ AuthnAuthorityDescriptors []AuthnAuthorityDescriptor

+ CacheDuration time.Duration

+ ContactPerson *ContactPerson

+ EntityID string

+ ID string

+ IDPSSODescriptors []IDPSSODescriptor

+ Organization *Organization

+ PDPDescriptors []PDPDescriptor

+ RoleDescriptors []RoleDescriptor

+ SPSSODescriptors []SPSSODescriptor

+ Signature *etree.Element

+ ValidUntil time.Time

+ XMLName xml.Name

+ func (m *EntityDescriptor) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ func (m EntityDescriptor) MarshalXML(e *xml.Encoder, start xml.StartElement) error

+ type IDPSSODescriptor struct

+ AssertionIDRequestServices []Endpoint

+ AttributeProfiles []string

+ Attributes []Attribute

+ NameIDMappingServices []Endpoint

+ SingleSignOnServices []Endpoint

+ WantAuthnRequestsSigned *bool

+ XMLName xml.Name

+ type IdentityProvider struct

+ AssertionMaker AssertionMaker

+ Certificate *x509.Certificate

+ Intermediates []*x509.Certificate

+ Key crypto.PrivateKey

+ Logger logger.Interface

+ LogoutURL url.URL

+ MetadataURL url.URL

+ SSOURL url.URL

+ ServiceProviderProvider ServiceProviderProvider

+ SessionProvider SessionProvider

+ SignatureMethod string

+ func (idp *IdentityProvider) Handler() http.Handler

+ func (idp *IdentityProvider) Metadata() *EntityDescriptor

+ func (idp *IdentityProvider) ServeIDPInitiated(w http.ResponseWriter, r *http.Request, serviceProviderID string, ...)

+ func (idp *IdentityProvider) ServeMetadata(w http.ResponseWriter, r *http.Request)

+ func (idp *IdentityProvider) ServeSSO(w http.ResponseWriter, r *http.Request)

+ type IdpAuthnRequest struct

+ ACSEndpoint *IndexedEndpoint

+ Assertion *Assertion

+ AssertionEl *etree.Element

+ HTTPRequest *http.Request

+ IDP *IdentityProvider

+ Now time.Time

+ RelayState string

+ Request AuthnRequest

+ RequestBuffer []byte

+ ResponseEl *etree.Element

+ SPSSODescriptor *SPSSODescriptor

+ ServiceProviderMetadata *EntityDescriptor

+ func NewIdpAuthnRequest(idp *IdentityProvider, r *http.Request) (*IdpAuthnRequest, error)

+ func (req *IdpAuthnRequest) MakeAssertionEl() error

+ func (req *IdpAuthnRequest) MakeResponse() error

+ func (req *IdpAuthnRequest) Validate() error

+ func (req *IdpAuthnRequest) WriteResponse(w http.ResponseWriter) error

+ type IndexedEndpoint struct

+ Binding string

+ Index int

+ IsDefault *bool

+ Location string

+ ResponseLocation *string

+ type InvalidResponseError struct

+ Now time.Time

+ PrivateErr error

+ Response string

+ func (ivr *InvalidResponseError) Error() string

+ type Issuer struct

+ Format string

+ NameQualifier string

+ SPNameQualifier string

+ SPProvidedID string

+ Value string

+ XMLName xml.Name

+ func (a *Issuer) Element() *etree.Element

+ type KeyDescriptor struct

+ EncryptionMethods []EncryptionMethod

+ KeyInfo KeyInfo

+ Use string

+ type KeyInfo struct

+ Certificate string

+ XMLName xml.Name

+ type LocalizedName struct

+ Lang string

+ Value string

+ type LocalizedURI struct

+ Lang string

+ Value string

+ type LogoutRequest struct

+ Destination string

+ ID string

+ IssueInstant time.Time

+ Issuer *Issuer

+ NameID *NameID

+ SessionIndex string

+ Signature *etree.Element

+ Version string

+ XMLName xml.Name

+ func (r *LogoutRequest) Element() *etree.Element

+ func (r *LogoutRequest) MarshalXML(e *xml.Encoder, start xml.StartElement) error

+ func (r *LogoutRequest) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ type LogoutResponse struct

+ Consent string

+ Destination string

+ ID string

+ InResponseTo string

+ IssueInstant time.Time

+ Issuer *Issuer

+ Signature *etree.Element

+ Status Status

+ Version string

+ XMLName xml.Name

+ func (r *LogoutResponse) Element() *etree.Element

+ func (r *LogoutResponse) MarshalXML(e *xml.Encoder, start xml.StartElement) error

+ func (r *LogoutResponse) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ type NameID struct

+ Format string

+ NameQualifier string

+ SPNameQualifier string

+ SPProvidedID string

+ Value string

+ func (a *NameID) Element() *etree.Element

+ type NameIDFormat string

+ const EmailAddressNameIDFormat

+ const PersistentNameIDFormat

+ const TransientNameIDFormat

+ const UnspecifiedNameIDFormat

+ func (n NameIDFormat) Element() *etree.Element

+ type NameIDPolicy struct

+ AllowCreate *bool

+ Format *string

+ SPNameQualifier *string

+ XMLName xml.Name

+ func (a *NameIDPolicy) Element() *etree.Element

+ type OneTimeUse struct

+ func (a *OneTimeUse) Element() *etree.Element

+ type Organization struct

+ OrganizationDisplayNames []LocalizedName

+ OrganizationNames []LocalizedName

+ OrganizationURLs []LocalizedURI

+ type PDPDescriptor struct

+ AssertionIDRequestServices []Endpoint

+ AuthzServices []Endpoint

+ NameIDFormats []NameIDFormat

+ type ProxyRestriction struct

+ Audiences []Audience

+ Count *int

+ func (a *ProxyRestriction) Element() *etree.Element

+ type RelaxedTime time.Time

+ func (m *RelaxedTime) UnmarshalText(text []byte) error

+ func (m RelaxedTime) MarshalText() ([]byte, error)

+ func (m RelaxedTime) String() string

+ type RequestedAttribute struct

+ IsRequired *bool

+ type Response struct

+ Assertion *Assertion

+ Consent string

+ Destination string

+ EncryptedAssertion *etree.Element

+ ID string

+ InResponseTo string

+ IssueInstant time.Time

+ Issuer *Issuer

+ Signature *etree.Element

+ Status Status

+ Version string

+ XMLName xml.Name

+ func (r *Response) Element() *etree.Element

+ func (r *Response) MarshalXML(e *xml.Encoder, start xml.StartElement) error

+ func (r *Response) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ type RoleDescriptor struct

+ CacheDuration time.Duration

+ ContactPeople []ContactPerson

+ ErrorURL string

+ ID string

+ KeyDescriptors []KeyDescriptor

+ Organization *Organization

+ ProtocolSupportEnumeration string

+ Signature *etree.Element

+ ValidUntil *time.Time

+ type SPSSODescriptor struct

+ AssertionConsumerServices []IndexedEndpoint

+ AttributeConsumingServices []AttributeConsumingService

+ AuthnRequestsSigned *bool

+ WantAssertionsSigned *bool

+ XMLName xml.Name

+ type SSODescriptor struct

+ ArtifactResolutionServices []IndexedEndpoint

+ ManageNameIDServices []Endpoint

+ NameIDFormats []NameIDFormat

+ SingleLogoutServices []Endpoint

+ type ServiceProvider struct

+ AcsURL url.URL

+ AllowIDPInitiated bool

+ AuthnNameIDFormat NameIDFormat

+ Certificate *x509.Certificate

+ ForceAuthn *bool

+ IDPMetadata *EntityDescriptor

+ Intermediates []*x509.Certificate

+ Key *rsa.PrivateKey

+ Logger logger.Interface

+ MetadataURL url.URL

+ MetadataValidDuration time.Duration

+ SloURL url.URL

+ func (sp *ServiceProvider) GetSLOBindingLocation(binding string) string

+ func (sp *ServiceProvider) GetSSOBindingLocation(binding string) string

+ func (sp *ServiceProvider) MakeAuthenticationRequest(idpURL string) (*AuthnRequest, error)

+ func (sp *ServiceProvider) MakeLogoutRequest(idpURL, nameID string) (*LogoutRequest, error)

+ func (sp *ServiceProvider) MakePostAuthenticationRequest(relayState string) ([]byte, error)

+ func (sp *ServiceProvider) MakeRedirectAuthenticationRequest(relayState string) (*url.URL, error)

+ func (sp *ServiceProvider) MakeRedirectLogoutRequest(nameID string) (*LogoutRequest, error)

+ func (sp *ServiceProvider) Metadata() *EntityDescriptor

+ func (sp *ServiceProvider) ParseResponse(req *http.Request, possibleRequestIDs []string) (*Assertion, error)

+ func (sp *ServiceProvider) ParseXMLResponse(decodedResponseXML []byte, possibleRequestIDs []string) (*Assertion, error)

+ func (sp *ServiceProvider) ValidateLogoutResponse(r *http.Request) error

+ type ServiceProviderProvider interface

+ GetServiceProvider func(r *http.Request, serviceProviderID string) (*EntityDescriptor, error)

+ type Session struct

+ CreateTime time.Time

+ ExpireTime time.Time

+ Groups []string

+ ID string

+ Index string

+ NameID string

+ UserCommonName string

+ UserEmail string

+ UserGivenName string

+ UserName string

+ UserScopedAffiliation string

+ UserSurname string

+ type SessionProvider interface

+ GetSession func(w http.ResponseWriter, r *http.Request, req *IdpAuthnRequest) *Session

+ type Status struct

+ StatusCode StatusCode

+ StatusDetail *StatusDetail

+ StatusMessage *StatusMessage

+ XMLName xml.Name

+ func (s *Status) Element() *etree.Element

+ type StatusCode struct

+ StatusCode *StatusCode

+ Value string

+ XMLName xml.Name

+ func (s *StatusCode) Element() *etree.Element

+ type StatusDetail struct

+ Children []*etree.Element

+ func (sm StatusDetail) Element() *etree.Element

+ type StatusMessage struct

+ Value string

+ func (sm StatusMessage) Element() *etree.Element

+ type Subject struct

+ NameID *NameID

+ SubjectConfirmations []SubjectConfirmation

+ XMLName xml.Name

+ func (a *Subject) Element() *etree.Element

+ type SubjectConfirmation struct

+ Method string

+ NameID *NameID

+ SubjectConfirmationData *SubjectConfirmationData

+ func (a *SubjectConfirmation) Element() *etree.Element

+ type SubjectConfirmationData struct

+ Address string

+ InResponseTo string

+ NotBefore time.Time

+ NotOnOrAfter time.Time

+ Recipient string

+ func (s *SubjectConfirmationData) Element() *etree.Element

+ func (s *SubjectConfirmationData) MarshalXML(e *xml.Encoder, start xml.StartElement) error

+ func (s *SubjectConfirmationData) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

+ type SubjectLocality struct

+ Address string

+ DNSName string

+ func (a *SubjectLocality) Element() *etree.Element

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL