crates/nornir-auth-saml/Cargo.toml
[package]
name = "nornir-auth-saml"
version = "0.1.3"
edition = "2021"
authors = ["Ignalina ApS"]
description = "SAML 2.0 (enterprise SSO) Service Provider for the nordisk servers, in pure Rust: verifies a browser-posted SAML Response (HTTP-POST binding) with exclusive C14N and enveloped RSA-SHA2 / ECDSA-P-256 XML-DSig against the configured IdP certificate only, XSW-proof, then checks issuer, audience, Destination, Recipient, InResponseTo and the time window (skew capped at 300 s). Builds the AuthnRequest (HTTP-Redirect) and both metadata documents. No samael, no C. Enables ADFS / Entra ID / Okta / Ping / Keycloak SAML estates."
license = "MIT OR Apache-2.0"
repository = "https://git.gunnar.rs/nordisk/edda"
keywords = ["auth", "saml", "sso", "xml-dsig", "enterprise"]
categories = ["authentication"]
[lib]
name = "nornir_auth_saml"
[features]
default = []
# `sp` — the PURE-RUST SP verifier (`nornir_auth_saml::sp`): HTTP-POST binding
# only, exclusive C14N + enveloped RSA/ECDSA XML-DSig, strict SAML 2.0 checks,
# XSW-proof. NO C: a guarded static appliance (gunnar forbids `openssl`
# everywhere) links it. Off by default; every dependency it adds is optional.
# (The samael-backed `saml` feature is gone, A34-14.)
sp = ["dep:roxmltree", "dep:rsa", "dep:sha2", "dep:p256", "dep:x509-cert", "dep:base64", "dep:flate2"]
# `test-support` — a pure-Rust SIGNER with a fixed, throwaway TEST-ONLY key, so a
# downstream crate's tests can run a fake IdP in-process. Never in a release build.
test-support = ["sp"]
[dependencies]
# The `sp` feature's closure — pinned to the majors the consumers (gunnar) already
# resolve, so turning `sp` on adds no second copy of any of them.
roxmltree = { version = "0.20", optional = true }
rsa = { version = "0.10.0-rc.18", default-features = false, features = ["std", "encoding"], optional = true }
sha2 = { version = "0.11", default-features = false, features = ["oid"], optional = true }
p256 = { version = "0.14", default-features = false, features = ["ecdsa", "std"], optional = true }
x509-cert = { version = "0.3", default-features = false, features = ["std"], optional = true }
base64 = { version = "0.22", optional = true }
flate2 = { version = "1", default-features = false, features = ["rust_backend"], optional = true }