SAML 2.0 sign-in for Rust, at both ends

Readme

Sign a person in with SAML 2.0, or issue that login from your own identity provider. Signatures and encryption go through bergshamra, so the build does not need libxml2, xmlsec1, or OpenSSL.

Cargo.toml

[dependencies]
saml-rs = "0.6"

The package name is saml-rs. Rust imports saml_rs. Method signatures live on docs.rs.

Start here

01Run the exampleOne program plays both sides and prints alice@example.com.02Accept a loginYou already have an identity provider and an assertion consumer URL.03Issue a loginYou authenticate the person and return a response.04End a sessionSingle Logout from either role, one peer per call.05Pick a crypto providerRustCrypto by default. AWS-LC and FIPS behind features.06Trust the signatureWhat the signature adapter already turns on, and what you still choose.

Service provider

sp.rs

let sp = Saml::sp(
    SpConfig::builder(EntityId::try_new("https://sp.example.com/metadata")?)
        .acs_endpoint(AcsEndpoint::post("https://sp.example.com/acs")?)
        .credentials(credentials)
        .validation(SpValidationPolicy::recommended())
        .build()?,
)?;

let started = sp.start_sso(&idp, StartSso::redirect())?;

Store started.pending, send started.outbound to the browser, and call finish_sso when it posts back. The full flow is in Service provider.

Before production

Pre-1.0

A minor release can change the API. There has been no external security audit. Pin the peer’s metadata signing key, and read XML signatures before production.

Reference

01CoverageWhich profiles, bindings, and roles the crate implements.02ConformanceEach rule with its OASIS section, actor, direction, and level.03SecurityDefaults, limits, and what stays off until you opt in.