hyperscale-stack / security / 38225732244

98%

push

github

feat(saml): add a SAML 2.0 Service Provider

Add saml/sp (package samlsp), a SAML 2.0 Service Provider for
SP-initiated Web Browser SSO (Profiles §4.1): HTTP-Redirect
AuthnRequests, optionally signed, an HTTP-POST ACS, per-connection SP
metadata, and IdP metadata imported or fetched through outbound (pinned
entity ID, same-origin redirects, bounded refresh off the login path).
Each connection has its own SP entity ID and ACS URL; a response is
bound to the browser (__Host- cookie), the connection and the request,
consumed atomically and recorded in a replay cache.

XML-DSig is gosaml2 + goxmldsig >= v1.6.1, behind a streaming lexical
gate (size, elements, depth, namespaces, no DTD) and a structural
profile refusing signature wrapping, duplicate IDs, attribute-name
parser differentials, SHA-1 unless a connection opts in, inclusive
C14N, encrypted assertions and ambiguous shapes (several assertions, no
NameID, no Issuer); identity is read from the verified canonical bytes.
A signed Response or a signed Assertion is accepted (errata E93, E26).

Storage: interface, memory store and conformance suite, plus SQL and
Redis stores as separate modules. Interop in the test-only
internal/interop/saml (crewjam/saml IdP, pinned Keycloak 26.0.7
response); runnable examples/saml-sp; security considerations,
LIMITATIONS, MIGRATION, CHANGELOG, architecture and observability docs.
Refs #87.

2937 of 2961 new or added lines in 25 files covered. (99.19%)

12348 of 12678 relevant lines covered (97.4%)

1234.12 hits per line